26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e3133d6068eb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e3133d6068eb…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4"],"about":{"@type":"SoftwareApplication","name":"mpclient.dll","applicationCategory":["pedll","64bits","executable"],"identifier":"e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4af,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "mpclient.dll") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "mpclient.dll") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "mpclient.dll") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "mpclient.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "mpclient.dll") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; File: "mpclient.dll") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002072.00000001.224454.00400000.00000004.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")28:T471,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "mpclient.dll") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "mpclient.dll") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "mpclient.dll") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "mpclient.dll") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "mpclient.dll") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "mpclient.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")29:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2412800648 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2412826795 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2413756460 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2413762989 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2414889717 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2414899606 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2416307885 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2416945490 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2417184579 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2417250667 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2417284506 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2417523733 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2417554657 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2417648499 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2420661510 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00002288-00000C15-2420669580 [PID: 2288] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2412963220 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2412969587 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2413859150 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2413866066 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2415174229 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2415349105 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2417212286 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2417320761 [PID: 1792] "rundll32.exe" queried SystemProcessInformation at 00000000-00001792-00000C15-2417505252 [PID: 1792]2a:T7fb2,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg" (Indicator: "CertOpenStore"; File: "mpclient.dll") Found api reference "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %sVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "mpclient.dll") Found api reference "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %sVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "mpclient.dll") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.Typex509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stac" (Indicator: "CryptReleaseContext"; File: "mpclient.dll") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWT+14:00.000 deep-seaT+57:30.000 all-fastinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed" (Indicator: "CertOpenSystemStoreW"; File: "mpclient.dll") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWT+14:00.000 deep-seaT+57:30.000 all-fastinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed" (Indicator: "CryptAcquireContextW"; File: "mpclient.dll") Found api reference "ntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Type4656612873077392578125unexpected method stepexit hook invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allo" (Indicator: "CertGetCertificateChain"; File: "mpclient.dll") Found api reference "cs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: T+55:30.000 pilot-aboardconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap" (Indicator: "CertFreeCertificateChain"; File: "mpclient.dll") Found api reference ": %.1f%%invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked" (Indicator: "CertEnumCertificatesInStore"; File: "mpclient.dll") Found api reference ": %.1f%%invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked" (Indicator: "CertFreeCertificateContext"; File: "mpclient.dll") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workco" (Indicator: "CertCreateCertificateContext"; File: "mpclient.dll") Found api reference "s: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "mpclient.dll") Found api reference "s: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "mpclient.dll") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxch" (Indicator: "CertOpenStore"; File: "mpclient.dll") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.Typex509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 sta" (Indicator: "CryptReleaseContext"; File: "mpclient.dll") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWT+14:00.000 deep-seaT+57:30.000 all-fastinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushe" (Indicator: "CertOpenSystemStoreW"; File: "mpclient.dll") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWT+14:00.000 deep-seaT+57:30.000 all-fastinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushe" (Indicator: "CryptAcquireContextW"; File: "mpclient.dll") Found api reference "ntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Type4656612873077392578125unexpected method stepexit hook invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/all" (Indicator: "CertGetCertificateChain"; File: "mpclient.dll") Found api reference "cs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: T+55:30.000 pilot-aboardconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/hea" (Indicator: "CertFreeCertificateChain"; File: "mpclient.dll") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workc" (Indicator: "CertCreateCertificateContext"; File: "mpclient.dll") Found api reference "runtime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "VirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "VirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference ", locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.Typex509negativeserialGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWT+14:00.000 deep-seaT+57:30.000 all-fastinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWT+14:00.000 deep-seaT+57:30.000 all-fastinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "exit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: T+55:30.000 pilot-aboardconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")2b:Tc2fe,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107"2c:T1145,Found XOR loop in file "sample.bin" at offset 90962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 371147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1337628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1362037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1364555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1399339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1435610; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1441244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1472779; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1570667; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1654187; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1684523; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1686012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1730266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1754027; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1821308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1864572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1868796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1884668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2163883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2243371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2264107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2318260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2336392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2672424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1433352; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2373137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2725196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 79621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 187574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 225385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 225745; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 228307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 250737; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 270864; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 413245; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 413886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 424265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1132880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1376522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1402436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1450948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1463498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1555242; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1747502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1805598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1939630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2025326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2513072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2942508; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2942520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2946036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2946144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2946756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2946840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2947008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3285574; code bytes = 80302d:T29f6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002288) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002288) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001792) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001792) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006548) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006548) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004412) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004412) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007208) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007208) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002072) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002072) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003332) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005676) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005676) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008740)2e:Ta7e,"rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002288-00000C17-2420605007 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002288-00000C17-2420607395 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001792-00000C17-2422744049 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001792-00000C17-2422746415 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006548-00000C17-2425582527 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006548-00000C17-2425585338 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004412-00000C17-2428595728 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004412-00000C17-2428598046 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007208-00000C17-2431487596 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007208-00000C17-2431492898 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002072-00000C17-2438614962 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002072-00000C17-2438618179 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003332-00000C17-2434425424 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003332-00000C17-2434427759 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005676-00000C17-2442294971 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005676-00000C17-2442297371 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008740-00000C17-2448717139 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008740-00000C17-2448719639 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008020-00000C17-2445251903 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008020-00000C17-2445257039 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000920-00000C17-2453549514 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000920-00000C17-2453551838 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003904-00000C17-2451737020 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003904-00000C17-24517394192f:T5ae,"rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")30:T496,"rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\089f4a7e (UID: 00000000-00002288) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\17362802 (UID: 00000000-00001792) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\0ed7e12c (UID: 00000000-00006548) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\f2bef11c (UID: 00000000-00004412) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\6fe40b0a (UID: 00000000-00007208) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\71b758ee (UID: 00000000-00002072) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\b0b1dde8 (UID: 00000000-00003332) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\a1d1535e (UID: 00000000-00005676) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\192f8e0a (UID: 00000000-00008740) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\dabf8419 (UID: 00000000-00008020) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\7b63fd7b (UID: 00000000-00000920) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\10b8cd20 (UID: 00000000-00003904)31:T350f,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002288) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001792) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006548) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004412) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007208) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002072) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003332) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005676) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00008740) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00008020) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000920) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003904) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008776) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008776) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00008776) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008776) "rundll32.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00008776) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008776)32:T1c67,Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "mpclient.dll") Found reference to API (Indicator: "MultiByteToWideChar"; File: "mpclient.dll") Found reference to API (Indicator: "SetErrorMode"; File: "mpclient.dll") Found reference to API (Indicator: "WaitForSingleObject"; File: "mpclient.dll") Found reference to API (Indicator: "GetLastError"; File: "mpclient.dll") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "mpclient.dll") Found reference to API (Indicator: "CloseHandle"; File: "mpclient.dll") Found reference to API (Indicator: "RaiseFailFastException"; File: "mpclient.dll") Found reference to API (Indicator: "WerSetFlags"; File: "mpclient.dll") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "mpclient.dll") Found reference to API (Indicator: "GetProcAddress"; File: "mpclient.dll") Found reference to API (Indicator: "GetCurrentThreadId"; File: "mpclient.dll") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "mpclient.dll") Found reference to API (Indicator: "GetThreadContext"; File: "mpclient.dll") Found reference to API (Indicator: "CreateEventA"; File: "mpclient.dll") Found reference to API (Indicator: "GetErrorMode"; File: "mpclient.dll") Found reference to API (Indicator: "GetSystemInfo"; File: "mpclient.dll") Found reference to API (Indicator: "DeleteCriticalSection"; File: "mpclient.dll") Found reference to API (Indicator: "LoadLibraryW"; File: "mpclient.dll") Found reference to API (Indicator: "SetWaitableTimer"; File: "mpclient.dll") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "mpclient.dll") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "mpclient.dll") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "mpclient.dll") Found reference to API (Indicator: "InitializeCriticalSection"; File: "mpclient.dll") Found reference to API (Indicator: "TlsGetValue"; File: "mpclient.dll") Found reference to API (Indicator: "VirtualAlloc"; File: "mpclient.dll") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "mpclient.dll") Found reference to API (Indicator: "WideCharToMultiByte"; File: "mpclient.dll") Found reference to API (Indicator: "DuplicateHandle"; File: "mpclient.dll") Found reference to API (Indicator: "Sleep"; File: "mpclient.dll") Found reference to API (Indicator: "WriteConsoleW"; File: "mpclient.dll") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "mpclient.dll") Found reference to API (Indicator: "EnterCriticalSection"; File: "mpclient.dll") Found reference to API (Indicator: "LoadLibraryExW"; File: "mpclient.dll") Found reference to API (Indicator: "WerGetFlags"; File: "mpclient.dll") Found reference to API (Indicator: "VirtualFree"; File: "mpclient.dll") Found reference to API (Indicator: "TlsAlloc"; File: "mpclient.dll") Found reference to API (Indicator: "ResumeThread"; File: "mpclient.dll") Found reference to API (Indicator: "WriteFile"; File: "mpclient.dll") Found reference to API (Indicator: "GetConsoleMode"; File: "mpclient.dll") Found reference to API (Indicator: "VirtualProtect"; File: "mpclient.dll") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "mpclient.dll") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "mpclient.dll") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "mpclient.dll") Found reference to API (Indicator: "SuspendThread"; File: "mpclient.dll") Found reference to API (Indicator: "SwitchToThread"; File: "mpclient.dll") Found reference to API (Indicator: "LeaveCriticalSection"; File: "mpclient.dll") Found reference to API (Indicator: "SetEvent"; File: "mpclient.dll") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "mpclient.dll") Found reference to API (Indicator: "SetThreadContext"; File: "mpclient.dll") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "mpclient.dll") Found reference to API (Indicator: "ExitProcess"; File: "mpclient.dll") Found reference to API (Indicator: "VirtualQuery"; File: "mpclient.dll") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "mpclient.dll") Found reference to API (Indicator: "GetStdHandle"; File: "mpclient.dll") Found reference to API (Indicator: "CreateThread"; File: "mpclient.dll") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "mpclient.dll") Found reference to API (Indicator: "WSAIoctl"; File: "mpclient.dll") Found reference to API (Indicator: "GetFileType"; File: "mpclient.dll") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "mpclient.dll") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000920.00000000.224784.ACA42000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002072.00000001.224454.00400000.00000004.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")33:T43a,"mpclient.dll" contains export function called "MpAllocMemory" at ordinal 1 "mpclient.dll" contains export function called "MpClientUtilExportFunctions" at ordinal 2 "mpclient.dll" contains export function called "MpConfigClose" at ordinal 3 "mpclient.dll" contains export function called "MpConfigGetValue" at ordinal 4 "mpclient.dll" contains export function called "MpConfigGetValueAlloc" at ordinal 5 "mpclient.dll" contains export function called "MpConfigInitialize" at ordinal 6 "mpclient.dll" contains export function called "MpConfigOpen" at ordinal 7 "mpclient.dll" contains export function called "MpConfigRegisterForNotifications" at ordinal 8 "mpclient.dll" contains export function called "MpConfigSetValue" at ordinal 9 "mpclient.dll" contains export function called "MpConfigUninitialize" at ordinal 10 "mpclient.dll" contains export function called "MpConfigUnregisterNotifications" at ordinal 11 "mpclient.dll" contains export function called "MpFreeMemory" at ordinal 12 "mpclient.dll" contains export function called "_cgo_dummy_export" at ordinal 1334:T588,Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2288:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Gernsoalse" Process rundll32.exe created mutex with name "Local\SM0:2288:304:WilStaging_02" Process rundll32.exe created mutex with name "Gernsoalse" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1792:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:1792:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6548:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:6548:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4412:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:4412:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7208:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:7208:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2072:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:2072:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3332:304:WilStaging_02"35:T494,Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#2" (UID: 00000000-00002288) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#3" (UID: 00000000-00001792) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#1" (UID: 00000000-00006548) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#4" (UID: 00000000-00004412) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#5" (UID: 00000000-00007208) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#6" (UID: 00000000-00002072) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#7" (UID: 00000000-00003332) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#8" (UID: 00000000-00005676) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#9" (UID: 00000000-00008740) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#10" (UID: 00000000-00008020) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#11" (UID: 00000000-00000920) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#12" (UID: 00000000-00003904) Process "rundll32.exe" with commandline ""C:\\mpclient.dll",#13" (UID: 00000000-00008776)36:T715,Found string "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "user-agent: "; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "user-agent: "; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0" (Indicator: "user-agent: "; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp")37:T5b6,"Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00000920.00000001.225281.48C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00002072.00000001.224454.2A640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00002288.00000001.223207.55330000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00003332.00000001.224219.57E40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00003904.00000001.225168.920F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004412.00000001.223768.72E20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00005676.00000001.224651.61FD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00006548.00000001.223579.D6980000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00007208.00000001.223950.61CA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00008020.00000001.224857.C79D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp38:Taf2,"rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1c355430000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffad37e0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffad37e0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffad37e0000 "rundll32.exe" loaded module "KERNEL32" at base 7ffad4e10000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffabedd0000 "rundll32.exe" loaded module "C:\MPCLIENT.DLL" at base 7ffaac720000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffad0ba0000 "rundll32.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffad36c0000 "rundll32.exe" loaded module "NTDLL.DLL" at base 7ffad6150000 "rundll32.exe" loaded module "POWRPROF.DLL" at base 7ffad3440000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7ffad4e10000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 7ffad6060000 "rundll32.exe" loaded module "BCRYPT.DLL" at base 7ffad2e50000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffad36c0000 "rundll32.exe" loaded module "WINHTTP.DLL" at base 7ffaccfe0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffab6920000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 7ffad4ee0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffad2a30000 "rundll32.exe" loaded module "SSPICLI.DLL" at base 7ffad2810000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffad2430000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffac0900000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffad2530000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1e9ddf50000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 249d6f90000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2a972f40000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1ca62020000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1c52a840000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1eb581e0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1cc62350000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2170cb70000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 242c7bd0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2c048e30000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 23792330000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 27088830000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7ffad4e1000039:T49a,Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#3" (UID: 00000000-00001792) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#1" (UID: 00000000-00006548) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#4" (UID: 00000000-00004412) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#5" (UID: 00000000-00007208) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#6" (UID: 00000000-00002072) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#7" (UID: 00000000-00003332) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#8" (UID: 00000000-00005676) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#9" (UID: 00000000-00008740) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#10" (UID: 00000000-00008020) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#11" (UID: 00000000-00000920) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#12" (UID: 00000000-00003904) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#13" (UID: 00000000-00008776)3a:T49a,Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#3" (UID: 00000000-00001792) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#1" (UID: 00000000-00006548) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#4" (UID: 00000000-00004412) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#5" (UID: 00000000-00007208) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#6" (UID: 00000000-00002072) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#7" (UID: 00000000-00003332) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#8" (UID: 00000000-00005676) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#9" (UID: 00000000-00008740) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#10" (UID: 00000000-00008020) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#11" (UID: 00000000-00000920) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#12" (UID: 00000000-00003904) Spawned process "rundll32.exe" with commandline ""C:\\mpclient.dll",#13" (UID: 00000000-00008776)3b:T6e3,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS\DNSCACHE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\307BDA19-231D3A25"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\307BDA19"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: ""; Value: "")3c:Tf6e,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1070F044-721C-504B-C01C-671DADCBC77D"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SHARECREDSWITHWINHTTP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "ENABLETOKENBINDING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "FORCEDEFAULTSECUREPROTOCOLS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DEFAULTSECUREPROTOCOLS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "LEGACYTLSAPPCOMPAT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "LEGACYTLSAPPCOMPAT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "LEGACYTLSAPPCOMPAT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "LEGACYTLSAPPCOMPAT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DISABLEBRANCHCACHE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DISABLEAUTOPROXYAUTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "AUTOPROXYQUERYWITHFULLURL"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "ENABLEDEFAULTHTTP2"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DEFAULTIPV6FASTFALLBACK"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DEFAULTDISABLESECUREPROTOCOLFALLBACK"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "ENABLEINSECURETLSFALLBACK"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "ENABLEHTTP2CLIENTCERTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "ALLOWHTTP2TRANSFERENCODING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DEFAULTHTTP2STREAMRECEIVEWINDOW"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DEFAULTHTTP2STREAMRECEIVEWINDOWUPDATEDELTA"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "DEFAULTUSESESSIONSCHCRED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLEPROXYAUTHENTICATIONSCHEMES"; Value: "")3d:T60f,Found reference to API "SetsockoptInt" (Indicator: "setsockopt"; File: "mpclient.dll") Found reference to API "SetsockoptIPMreq" (Indicator: "setsockopt"; File: "mpclient.dll") Found reference to API "SetsockoptLinger" (Indicator: "setsockopt"; File: "mpclient.dll") Found reference to API "SetsockoptIPv6Mreq" (Indicator: "setsockopt"; File: "mpclient.dll") Found reference to API "SetsockoptInet4Addr" (Indicator: "setsockopt"; File: "mpclient.dll") file/memory contains long string with (Indicator: "setsockopt"; File: "mpclient.dll") Found reference to API "syscall.Setsockopt" (Indicator: "setsockopt"; File: "mpclient.dll") Found reference to API "syscall.SetsockoptInt" (Indicator: "setsockopt"; File: "mpclient.dll") Found reference to API "SetsockoptInt" (Indicator: "setsockopt"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found reference to API "SetsockoptIPMreq" (Indicator: "setsockopt"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found reference to API "SetsockoptLinger" (Indicator: "setsockopt"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found reference to API "SetsockoptIPv6Mreq" (Indicator: "setsockopt"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found reference to API "SetsockoptInet4Addr" (Indicator: "setsockopt"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "setsockopt"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")3e:T14da,"rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c355372200" "dwHeadersLength": "0" "lpOptional": "------989375f5740053196784Content-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------989375f5740053196784Content-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------989375f5740053196784" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1e9ddcf4c10" "dwHeadersLength": "0" "lpOptional": "------69e053572745e60b42c7Content-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------69e053572745e60b42c7Content-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------69e053572745e60b42c7" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "249d69c4af0" "dwHeadersLength": "0" "lpOptional": "------ede2880f7c2162b86081Content-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------ede2880f7c2162b86081Content-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------ede2880f7c2162b86081" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2a972e67cf0" "dwHeadersLength": "0" "lpOptional": "------d9adfad347f68ddc279dContent-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d9adfad347f68ddc279dContent-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------d9adfad347f68ddc279d" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1ca61ce5c40" "dwHeadersLength": "0" "lpOptional": "------dadd84b089f8211e285bContent-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------dadd84b089f8211e285bContent-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------dadd84b089f8211e285b" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1c52a685300" "dwHeadersLength": "0" "lpOptional": "------57ccb09681e7ae94fbd0Content-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------57ccb09681e7ae94fbd0Content-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------57ccb09681e7ae94fbd0" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1eb57e84920" "dwHeadersLength": "0" "lpOptional": "------05fdc66a5478e061c677Content-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------05fdc66a5478e061c677Content-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------05fdc66a5478e061c677" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1cc62013600" "dwHeadersLength": "0" "lpOptional": "------cda2239f384de33da7fbContent-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------cda2239f384de33da7fbContent-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------cda2239f384de33da7fb" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2170c912da0" "dwHeadersLength": "0" "lpOptional": "------d84af5700079b1259b00Content-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d84af5700079b1259b00Content-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------d84af5700079b1259b00" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "242c7a15be0" "dwHeadersLength": "0" "lpOptional": "------64d140b59bdf75e2d42dContent-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------64d140b59bdf75e2d42dContent-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------64d140b59bdf75e2d42d" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2c048cd5e10" "dwHeadersLength": "0" "lpOptional": "------142281ca29622df1098cContent-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------142281ca29622df1098cContent-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------142281ca29622df1098c" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23792133b30" "dwHeadersLength": "0" "lpOptional": "------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name=\"hwid\"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name=\"build_id\"237fe39c6532ebb4dcb4820fc4753707------bcb5ea49f56bfc2a72db" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"}3f:T532,"rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1c355372200" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1e9ddcf4c10" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "249d69c4af0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2a972e67cf0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1ca61ce5c40" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1c52a685300" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1eb57e84920" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1cc62013600" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2170c912da0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "242c7a15be0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2c048cd5e10" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "23792133b30" "lpReserved": "0"}40:T793,file/memory contains long string with (Indicator: "WSARecv"; File: "mpclient.dll") file/memory contains long string with (Indicator: "WSASend"; File: "mpclient.dll") file/memory contains long string with (Indicator: "WSAStartup"; File: "mpclient.dll") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "mpclient.dll") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "mpclient.dll") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002288-00000C2B-2420877586") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002288-00000C2B-2420877637") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002288-00000C2B-2420877687") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002288-00000C2B-2420877687") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002288-00000C2B-2420877687") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002288-00000C2B-2420877739") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002288-00000C2B-2420877739") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002288-00000C2B-2420877921") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002288-00000C2B-2420877969") file/memory contains long string with (Indicator: "WSARecv"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "WSASend"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "WSAStartup"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")41:T327e,Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----989375f5740053196784Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------989375f5740053196784Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------989375f5740053196784Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------989375f5740053196784Content-Disposition: form-data; name="format"json------989375f5740053196784--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----69e053572745e60b42c7Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------69e053572745e60b42c7Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------69e053572745e60b42c7Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------69e053572745e60b42c7Content-Disposition: form-data; name="format"json------69e053572745e60b42c7--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----ede2880f7c2162b86081Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------ede2880f7c2162b86081Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------ede2880f7c2162b86081Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------ede2880f7c2162b86081Content-Disposition: form-data; name="format"json------ede2880f7c2162b86081--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d9adfad347f68ddc279dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------d9adfad347f68ddc279dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d9adfad347f68ddc279dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d9adfad347f68ddc279dContent-Disposition: form-data; name="format"json------d9adfad347f68ddc279d--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dadd84b089f8211e285bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------dadd84b089f8211e285bContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------dadd84b089f8211e285bContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------dadd84b089f8211e285bContent-Disposition: form-data; name="format"json------dadd84b089f8211e285b--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----05fdc66a5478e061c677Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------05fdc66a5478e061c677Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------05fdc66a5478e061c677Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------05fdc66a5478e061c677Content-Disposition: form-data; name="format"json------05fdc66a5478e061c677--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="format"json------57ccb09681e7ae94fbd0--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----cda2239f384de33da7fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------cda2239f384de33da7fbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------cda2239f384de33da7fbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------cda2239f384de33da7fbContent-Disposition: form-data; name="format"json------cda2239f384de33da7fb--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------64d140b59bdf75e2d42dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------64d140b59bdf75e2d42dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------64d140b59bdf75e2d42dContent-Disposition: form-data; name="format"json------64d140b59bdf75e2d42d--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----d84af5700079b1259b00Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------d84af5700079b1259b00Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d84af5700079b1259b00Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d84af5700079b1259b00Content-Disposition: form-data; name="format"json------d84af5700079b1259b00--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72dbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="format"json------bcb5ea49f56bfc2a72db--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----142281ca29622df1098cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0Content-Length: 345Host: 116.202.1.107------142281ca29622df1098cContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------142281ca29622df1098cContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------142281ca29622df1098cContent-Disposition: form-data; name="format"json------142281ca29622df1098c--"; File: "PCAP") Found string "------989375f5740053196784Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------989375f5740053196784Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------989375f5740053196784"; Source: "00000000-00002288-00000CCB-2422523236") Found string "------69e053572745e60b42c7Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------69e053572745e60b42c7Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------69e053572745e60b42c7"; Source: "00000000-00001792-00000CCB-2425009138") Found string "------ede2880f7c2162b86081Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------ede2880f7c2162b86081Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------ede2880f7c2162b86081"; Source: "00000000-00006548-00000CCB-2428266092") Found string "------d9adfad347f68ddc279dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d9adfad347f68ddc279dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d9adfad347f68ddc279d"; Source: "00000000-00004412-00000CCB-2431163388") Found string "------dadd84b089f8211e285bContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------dadd84b089f8211e285bContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------dadd84b089f8211e285b"; Source: "00000000-00007208-00000CCB-2433916058") Found string "------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------57ccb09681e7ae94fbd0"; Source: "00000000-00002072-00000CCB-2441936238") Found string "------05fdc66a5478e061c677Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------05fdc66a5478e061c677Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------05fdc66a5478e061c677"; Source: "00000000-00003332-00000CCB-2438172064") Found string "------cda2239f384de33da7fbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------cda2239f384de33da7fbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------cda2239f384de33da7fb"; Source: "00000000-00005676-00000CCB-2445057787") Found string "------d84af5700079b1259b00Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d84af5700079b1259b00Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d84af5700079b1259b00"; Source: "00000000-00008740-00000CCB-2451345287") Found string "------64d140b59bdf75e2d42dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------64d140b59bdf75e2d42dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------64d140b59bdf75e2d42d"; Source: "00000000-00008020-00000CCB-2448121807") Found string "------142281ca29622df1098cContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------142281ca29622df1098cContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------142281ca29622df1098c"; Source: "00000000-00000920-00000CCB-2454801929") Found string "------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------bcb5ea49f56bfc2a72db"; Source: "00000000-00003904-00000CCB-2453110109") Found string "Content-Type: multipart/form-data; boundary=----%s"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp")42:T4a1,file/memory contains long string with (Indicator: "wsastartup"; File: "mpclient.dll") file/memory contains long string with (Indicator: "wsacleanup"; File: "mpclient.dll") file/memory contains long string with (Indicator: "gethostbyname"; File: "mpclient.dll") file/memory contains long string with (Indicator: " send "; File: "mpclient.dll") file/memory contains long string with (Indicator: " socket "; File: "mpclient.dll") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "mpclient.dll") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: " socket "; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")43:T66d,"116.202.1.107" Potential IP "116.202.1.107" found in string "07s [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "27s [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "1:06 [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "1:49 [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "52s [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "1:41 [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "09s [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "1:13 [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "2:07 [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "1:37 [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "16s [*] Direct: https://116.202.1.107" Potential IP "116.202.1.107" found in string "ttps://116.202.1.107/" "16.202.1.107" Potential IP "116.202.1.107" found in string "s://116.202.1.107/" Potential IP "116.202.1.107" found in string "https://116.202.1.107/" Potential IP "116.202.1.107" found in string "ttps://116.202.1.107:443/" "2.5.29.19" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" Potential IP "2.5.29.3" found in string "2.5.29.3`" "2.5.29.1" "2.5.29.32" "2.5.29.15" "2.5.29.14" "2.5.29.31" "2.5.4.3" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.10" Potential IP "116.202.1.107" found in string "Host: 116.202.1.107" "67.233.135.46" "167.233.135.46"44:T98e,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "errors.is" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.value.int" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Pattern match: "eq.io/fs.patherror" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Pattern match: "https://116.202.1.107" Heuristic match: "ext=.com" Pattern match: "https://116.202.1.107/" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Heuristic match: "om/vslogo.gi" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "|$(.sh"45:T6918,Found URL "https://116.202.1.107/enclaveuthority" - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "https://116.202.1.107/" - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107116.202.1.107uthority" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "https://116.202.1.107/14171user-agent:" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmf%w0digicert" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found URL "https://116.202.1.107/cha116.202.1.107116.202.1.107116.202.1.107enclaveubject" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "https://116.202.1.107/@yh*" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl006n*l3n*r3n*@6n*f[-n*k,n*d4n*z4n*" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm[-n*+-n*pin*" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l_" - Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found URL "https://116.202.1.107/rrentve\internet" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "https://116.202.1.107/1344;9ab7ce10,4,01000sfapcloudapntlmwdigesttsssppku2umozilla/5.0" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0f%w0digicert" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l/?@uc?@uw?@uk?@u3@@ug@@u[@@uo@@u" - Source: "00000000-00002288.00000001.223207.55330000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107116.202.1.107rl" - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "https://116.202.1.107/negotiate" - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003332.00000001.224219.57E40000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107channelsssptsvcsey" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107116.202.1.107ey" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "https://116.202.1.107/kerberos2514171k8$2" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0hrbt1.2.840.113549.1.1.121.3.6.1.5.5.7.3.11.2.840.10045.4.3.31.2.840.10045.2.1xcpx" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003904.00000001.225168.920F0000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107116.202.1.107uthority" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "https://116.202.1.107/negotiatecache-controlno-cachea5032514171negoextenderkerberosmicrosoft" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris>1.2.840.10045.4.3.3microsoft" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookh" - Source: "00000000-00004412.00000001.223768.72E20000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107116.202.1.107rpc-2a797aedd1bdd22d51ubject" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "https://116.202.1.107/aun" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005676.00000001.224651.61FD0000.00000004.mdmp") Found URL "https://116.202.1.107/rpc-2a797aedd1bdd22d51ey" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "https://116.202.1.107/a5032514171negotiatekerberoscache-controlno-cacheu2k!" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0gcmqc;1.2.840.10045.2.11.2.840.10045.4.3.31.3.6.1.5.5.7.3.1" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006548.00000001.223579.D6980000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107asic" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107116.202.1.107ubject" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "https://116.202.1.107/cache-controlno-cacheposthttps://hrsthrst0.!z&r'hms+" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmf%w0digicert" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007208.00000001.223950.61CA0000.00000004.mdmp") Found URL "https://116.202.1.107/116.202.1.107116.202.1.107rpc-2a797aedd1bdd22d51uthority" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "https://116.202.1.107/cache-controlno-cacheposthttps://s+" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "http://c2.5.29.312.5.29.155e0dverisign," - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.12hrbtxcpx" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmn" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008020.00000001.224857.C79D0000.00000004.mdmp") Found URL "https://116.202.1.107/rrentve/\internet" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "https://116.202.1.107/user-agent:" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhnbj'v(z" - Source: "00000000-00008740.00000001.225056.0C8D0000.00000004.mdmp")46:T616,Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp")47:T4e2,file/memory contains long string with (Indicator: "GetUserName"; File: "mpclient.dll") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "mpclient.dll") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "mpclient.dll") file/memory contains long string with (Indicator: "LookupAccountName"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "mpclient.dll") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")48:T646,"rundll32.exe" called "GetComputerNameA" (UID: 00000000-00002288) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00002288) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00001792) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00001792) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00006548) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00006548) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004412) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004412) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00007208) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00007208) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00002072) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00002072) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00003332) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00003332) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00005676) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00005676) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00008740) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00008740) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00008020) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00008020) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00000920) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00000920) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00003904) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00003904)49:Ta0d,Found string "chacha8" (Indicator: "chacha"; File: "mpclient.dll") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "mpclient.dll") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "mpclient.dll") file/memory contains long string with (Indicator: "aes"; File: "mpclient.dll") file/memory contains long string with (Indicator: "3des"; File: "mpclient.dll") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "mpclient.dll") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "mpclient.dll") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "mpclient.dll") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "mpclient.dll") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "mpclient.dll") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "mpclient.dll") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "mpclient.dll") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "mpclient.dll") Found string "aeshashbody" (Indicator: "aes"; File: "mpclient.dll") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "mpclient.dll") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "mpclient.dll") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "ECDSA/SHA384" (Indicator: "ecdsa"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00002072.00000001.224454.2A640000.00000004.mdmp")4a:T805,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "mpclient.dll") file/memory contains long string with (Indicator: "Process32Next"; File: "mpclient.dll") file/memory contains long string with (Indicator: "Module32Next"; File: "mpclient.dll") file/memory contains long string with (Indicator: "Process32First"; File: "mpclient.dll") file/memory contains long string with (Indicator: "Module32First"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "mpclient.dll") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "mpclient.dll") Found reference to API "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s" (Indicator: "Module32Next"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")4b:T7d9,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "mpclient.dll") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetTempPath"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "mpclient.dll") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "mpclient.dll") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "mpclient.dll") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "mpclient.dll") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "mpclient.dll") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") Found reference to API "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s" (Indicator: "GetTempPath"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")4c:Ta75,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000920.00000000.224784.48C90000.00000004.mdmp, 00000000-00000920.00000000.224784.48EA0000.00000004.mdmp, 00000000-00000920.00000001.225281.48C90000.00000004.mdmp, 00000000-00000920.00000001.225281.48EA0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000920.00000000.224784.48C90000.00000004.mdmp, 00000000-00000920.00000000.224784.48EA0000.00000004.mdmp, 00000000-00000920.00000001.225281.48C90000.00000004.mdmp, 00000000-00000920.00000001.225281.48EA0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000920.00000000.224784.48C90000.00000004.mdmp, 00000000-00000920.00000001.225281.48C90000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001792.00000000.222831.DDCB0000.00000004.mdmp, 00000000-00001792.00000000.222831.DDFB0000.00000004.mdmp, 00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp, 00000000-00001792.00000001.223376.DDFB0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001792.00000000.222831.DDCB0000.00000004.mdmp, 00000000-00001792.00000000.222831.DDFB0000.00000004.mdmp, 00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp, 00000000-00001792.00000001.223376.DDFB0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001792.00000000.222831.DDCB0000.00000004.mdmp, 00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002072.00000000.223709.2A620000.00000004.mdmp, 00000000-00002072.00000000.223709.2A640000.00000004.mdmp, 00000000-00002072.00000001.224454.2A620000.00000004.mdmp, 00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002072.00000000.223709.2A620000.00000004.mdmp, 00000000-00002072.00000000.223709.2A640000.00000004.mdmp, 00000000-00002072.00000001.224454.2A620000.00000004.mdmp, 00000000-00002072.00000001.224454.2A640000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002072.00000000.223709.2A640000.00000004.mdmp, 00000000-00002072.00000001.224454.2A640000.00000004.mdmp")4d:Tac4,file/memory contains long string with (Indicator: "CopySid"; File: "mpclient.dll") file/memory contains long string with (Indicator: "IsValidSid"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetLengthSid"; File: "mpclient.dll") file/memory contains long string with (Indicator: "RevertToSelf"; File: "mpclient.dll") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "mpclient.dll") file/memory contains long string with (Indicator: "DuplicateToken"; File: "mpclient.dll") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "mpclient.dll") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "mpclient.dll") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "mpclient.dll") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "mpclient.dll") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "RevertToSelf"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateToken"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00002072.00000001.224454.AC811000.00000002.mdmp")4e:T9ce,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4f:T2dca,"POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----989375f5740053196784 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------989375f5740053196784Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------989375f5740053196784Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------989375f5740053196784Content-Disposition: form-data; name="format"json------989375f5740053196784--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:02 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----69e053572745e60b42c7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------69e053572745e60b42c7Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------69e053572745e60b42c7Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------69e053572745e60b42c7Content-Disposition: form-data; name="format"json------69e053572745e60b42c7--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:05 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ede2880f7c2162b86081 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------ede2880f7c2162b86081Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------ede2880f7c2162b86081Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------ede2880f7c2162b86081Content-Disposition: form-data; name="format"json------ede2880f7c2162b86081--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:08 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d9adfad347f68ddc279d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------d9adfad347f68ddc279dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d9adfad347f68ddc279dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d9adfad347f68ddc279dContent-Disposition: form-data; name="format"json------d9adfad347f68ddc279d--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:11 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----dadd84b089f8211e285b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------dadd84b089f8211e285bContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------dadd84b089f8211e285bContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------dadd84b089f8211e285bContent-Disposition: form-data; name="format"json------dadd84b089f8211e285b--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:14 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----05fdc66a5478e061c677 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------05fdc66a5478e061c677Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------05fdc66a5478e061c677Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------05fdc66a5478e061c677Content-Disposition: form-data; name="format"json------05fdc66a5478e061c677--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:18 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="format"json------57ccb09681e7ae94fbd0--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:22 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----cda2239f384de33da7fb Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------cda2239f384de33da7fbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------cda2239f384de33da7fbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------cda2239f384de33da7fbContent-Disposition: form-data; name="format"json------cda2239f384de33da7fb--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:25 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------64d140b59bdf75e2d42dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------64d140b59bdf75e2d42dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------64d140b59bdf75e2d42dContent-Disposition: form-data; name="format"json------64d140b59bdf75e2d42d--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:28 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d84af5700079b1259b00 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------d84af5700079b1259b00Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d84af5700079b1259b00Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d84af5700079b1259b00Content-Disposition: form-data; name="format"json------d84af5700079b1259b00--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:31 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72db Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="format"json------bcb5ea49f56bfc2a72db--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:33 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----142281ca29622df1098c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload::==> "------142281ca29622df1098cContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------142281ca29622df1098cContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------142281ca29622df1098cContent-Disposition: form-data; name="format"json------142281ca29622df1098c--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Tue 23 Jun 2026 03:53:35 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B.......50:Tb00,"rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "rundll32.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload" (Filter: 268435460; Subtree: 1) "rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1)51:T5aa,YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00002072" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00003904" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00003332" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00008020" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00000920" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00008740" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00007208" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00006548" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00001792" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00005676" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00002288" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004412"52:T447,"rundll32.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter System" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00002288) "rundll32.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00002288)53:Tb2f,"rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")54:T2392,"POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----989375f5740053196784 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------989375f5740053196784Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------989375f5740053196784Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------989375f5740053196784Content-Disposition: form-data; name="format"json------989375f5740053196784--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----69e053572745e60b42c7 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------69e053572745e60b42c7Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------69e053572745e60b42c7Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------69e053572745e60b42c7Content-Disposition: form-data; name="format"json------69e053572745e60b42c7--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ede2880f7c2162b86081 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------ede2880f7c2162b86081Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------ede2880f7c2162b86081Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------ede2880f7c2162b86081Content-Disposition: form-data; name="format"json------ede2880f7c2162b86081--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d9adfad347f68ddc279d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------d9adfad347f68ddc279dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d9adfad347f68ddc279dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d9adfad347f68ddc279dContent-Disposition: form-data; name="format"json------d9adfad347f68ddc279d--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----dadd84b089f8211e285b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------dadd84b089f8211e285bContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------dadd84b089f8211e285bContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------dadd84b089f8211e285bContent-Disposition: form-data; name="format"json------dadd84b089f8211e285b--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----05fdc66a5478e061c677 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------05fdc66a5478e061c677Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------05fdc66a5478e061c677Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------05fdc66a5478e061c677Content-Disposition: form-data; name="format"json------05fdc66a5478e061c677--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----57ccb09681e7ae94fbd0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------57ccb09681e7ae94fbd0Content-Disposition: form-data; name="format"json------57ccb09681e7ae94fbd0--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----cda2239f384de33da7fb Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------cda2239f384de33da7fbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------cda2239f384de33da7fbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------cda2239f384de33da7fbContent-Disposition: form-data; name="format"json------cda2239f384de33da7fb--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----64d140b59bdf75e2d42d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------64d140b59bdf75e2d42dContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------64d140b59bdf75e2d42dContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------64d140b59bdf75e2d42dContent-Disposition: form-data; name="format"json------64d140b59bdf75e2d42d--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d84af5700079b1259b00 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------d84af5700079b1259b00Content-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------d84af5700079b1259b00Content-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------d84af5700079b1259b00Content-Disposition: form-data; name="format"json------d84af5700079b1259b00--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bcb5ea49f56bfc2a72db Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------bcb5ea49f56bfc2a72dbContent-Disposition: form-data; name="format"json------bcb5ea49f56bfc2a72db--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----142281ca29622df1098c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0 Content-Length: 345 Host: 116.202.1.107" with payload:==> "------142281ca29622df1098cContent-Disposition: form-data; name="hwid"333AECFCDF8594E7A601-07de0940-fa46-0D15CD8------142281ca29622df1098cContent-Disposition: form-data; name="build_id"237fe39c6532ebb4dcb4820fc4753707------142281ca29622df1098cContent-Disposition: form-data; name="format"json------142281ca29622df1098c--"55:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=56:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=57:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=58:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=59:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5a:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5b:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5c:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5d:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=5e:T408,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACzElEQVR4Xu2U6U8TQRyG+fdMPIBYFAMGFAkRQznkMCVEocSgUWMMgkihUFu6vUtLj0XaYsthDdCqYKBKKFa2IsFqQj/w5XV2sQZ3+wF22+gHJnmyu7Mzv/eZ2aOg4H9sbc1NaGsRCZkrl8vBr3msxhba398XBTu387ZCmoRUgc34hjQJqQLsUZJELgQkSeRKgEWUBL/Iccg299gS2YpkiKzEYPW+gss/h710WnC/565S+Gn+ppXAz8ra+AJpErSzm+LO3f55mFx+GJ1TiCcY7O2lkWC2BSLZYOvys7I2voB3OgyLZxpu3xwXTDleQm+nYSRHapzGqNGJxFZSEMhHlMDmlyQs7gBMEz4YHFPQk8Axmxdaixsa8wQJd0BN2TE5PScI5CNKgH3OwXCEBE9ywYHZBa5v7dMGCR7HsN4GyuZBcvubIJCPKAGW7Z1d6KwevDC7sEqCM/0qnRWDWjN8oXlBWDZECXxP/YTV7YfGdLDdRgeN6PIqZsKLeK4xYWDUgD61HkvvlgWBfEQJJJiv3Es2YjjYbpXOwq16QGNE/wiFvuEx9A5pQQdmBIF8RAmwLERXQNnJ858Jk1Ub8YwE95NV620uOGk/hnVm8hUwCL5+g/X4piBYssBhDHYPng7p0KvSIv458ac/OB/GtYZW1LYouOtU6odgbk4EYuQlpAMheH1B7pqyO9HQ3oW6Wx2ovNGIyzV1aLvTjavX5WTseu4F+NQrOlElb8bNDiUCoVn0qdS4UFEFWVkl7E5X/gXef1hFRW09TGQnMn018iYoOpWCsXkRaO++h7LqWnT1PMAWwyASfYvCkks4UyyD2WbLv4Dy/iOUVlajpPwKikvLUSgr5cJPnS2C20vnX2CLSSJKfkKD6lGck13E6aLzWFyKIBgS/hfyIpBhLfYRDx8/gdn697YfJq8CR+FE4ETg6ALNjdzgnEPq8rP+efsFFI4OlP1P9nYAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791575834537,"unified_at":"2026-10-09T19:57:14.537Z","metadata":{"hashes":{"sha256":"e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4","sha1":"a94a7ac2111384fb8cc5d9b6e6e57417592201ac","md5":"e802d26922497c447c7152d0dc7f1c35","sha512":"4b21a32da7e066e083beacb778ccf3fd0098777b073e47d4fe293bec47021000879912dd6a9f41829f34b291d6640d9052c6e82eee84be0fc0928ae963925b0f","ssdeep":"49152:c9cLBV/chxUuSNFZGV1h11WxgJoTs3jeYPunyWbI:c6L0vAGV3jWjTsTe+u1bI","ssdeep_chunks":["49152:c9cLBV/","49152:9cLBV/c","49152:cLBV/ch","49152:LBV/chx","49152:BV/chxU","49152:V/chxUu","49152:/chxUuS","49152:chxUuSN","49152:hxUuSNF","49152:xUuSNFZ","49152:UuSNFZG","49152:uSNFZGV","49152:SNFZGV1","49152:NFZGV1h","49152:FZGV1h1","49152:ZGV1h11","49152:GV1h11W","49152:V1h11Wx","49152:1h11Wxg","49152:h11WxgJ","49152:11WxgJo","49152:1WxgJoT","49152:WxgJoTs","49152:xgJoTs3","49152:gJoTs3j","49152:JoTs3je","49152:oTs3jeY","49152:Ts3jeYP","49152:s3jeYPu","49152:3jeYPun","49152:jeYPuny","49152:eYPunyW","49152:YPunyWb","49152:PunyWbI","98304:c9cLBV/","98304:9cLBV/c","98304:cLBV/ch","98304:LBV/chx","98304:BV/chxU","98304:V/chxUu","98304:/chxUuS","98304:chxUuSN","98304:hxUuSNF","98304:xUuSNFZ","98304:UuSNFZG","98304:uSNFZGV","98304:SNFZGV1","98304:NFZGV1h","98304:FZGV1h1","98304:ZGV1h11","98304:GV1h11W","98304:V1h11Wx","98304:1h11Wxg","98304:h11WxgJ","98304:11WxgJo","98304:1WxgJoT","98304:WxgJoTs","98304:xgJoTs3","98304:gJoTs3j","98304:JoTs3je","98304:oTs3jeY","98304:Ts3jeYP","98304:s3jeYPu","98304:3jeYPun","98304:jeYPuny","98304:eYPunyW","98304:YPunyWb","98304:PunyWbI","49152:c6L0vAG","49152:6L0vAGV","49152:L0vAGV3","49152:0vAGV3j","49152:vAGV3jW","49152:AGV3jWj","49152:GV3jWjT","49152:V3jWjTs","49152:3jWjTsT","49152:jWjTsTe","49152:WjTsTe+","49152:jTsTe+u","49152:TsTe+u1","49152:sTe+u1b","49152:Te+u1bI"],"imphash":"d8b31f8c03e0c76ff245ed05a15ffe6c"},"file_info":{"file_name":"mpclient.dll","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":3377472,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1782186733000,"last_seen":1782219600000,"last_multi_scan":1782219600000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":164,"suspicious_count":19,"malicious_count":4,"total":187},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.UE trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Agent.MMK.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","identifiers":[{"type":"suspicious","value":"Able to disable driver signature enforcement"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":".rdata section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"mpclient.dll\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"mpclient.dll\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"mpclient.dll\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"OpenService\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000920.00000001.225281.48C90000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp\")\n Found reference to \"ECDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002072.00000001.224454.2A640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001792.00000000.222831.00400000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007056]\n Process \"WerFault.exe\" [UID: 00000000-00005348]\n Process \"WerFault.exe\" [UID: 00000000-00004356]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002288-00000C2B-2417178733\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00002288-00000C2B-2417178855\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002288-00000C2B-2417178901\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00002288-00000C2B-2417178940\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00002288-00000C2B-2417178979\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002288-00000C2B-2417179018\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"Observed string: \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s\" (Indicator: \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s\") in Source: 00000000-00002072.00000001.224454.AC811000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000920.00000001.225281.48C90000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002072.00000001.224454.2A640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002288-00000C2B-2416118257\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00001792.00000000.222831.DDCB0000.00000004.mdmp\")\n file/memory contains long string(Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002288-00000C2B-2416118257\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"mpclient.dll\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"mpclient.dll\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002288-00000C2B-2415489733\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"mpclient.dll\")\n file/memory contains long string(Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"mpclient.dll\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"mpclient.dll\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"mpclient.dll\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"mpclient.dll\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"mpclient.dll\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002288)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002288)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002288)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002288)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001792)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006548)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004412)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"mpclient.dll\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n Found reference to API \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s\" (Indicator: \"GetVersion\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"mpclient.dll\" has section name .rdata with entropy \"7.0224852342698245\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"mpclient.dll\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"mpclient.dll\"\n Found registry modification API: \"RegCreateKey (in long string)\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$30","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"116.202.1.107:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CreateFile\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 45875-7431-00000001E5DBBCF8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"mpclient.dll\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"mpclient.dll\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"mpclient.dll\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"mpclient.dll\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"mpclient.dll\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"mpclient.dll\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000920.00000000.224784.ACA42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$33","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00000920.00000001.225281.48C90000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00002072.00000001.224454.2A640000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$34","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$35","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"mpclient.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$37","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D36C0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D2E50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D4EE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"mpclient.dll\" was detected as \"MinGW\" and name: \"Compiler\"\n \"mpclient.dll\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"mpclient.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"mpclient.dll\" has an writable section named \".data\"\n \"mpclient.dll\" has an writable section named \".bss\"\n \"mpclient.dll\" has an writable section named \".idata\"\n \"mpclient.dll\" has an writable section named \".CRT\"\n \"mpclient.dll\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"mpclient.dll\" file has an entrypoint instructions - \"mov\trax, qword ptr [rip + 0x2cb5b9],mov\tdword ptr [rax], 0,jmp\t0x1e5ce1200,nop\tword ptr cs:[rax + rax],nop\tdword ptr [rax],mov\trdx, rcx,lea\trcx, [rip + 0x2d2c86],jmp\t0x1e5dc1ec0,nop\t,lea\trcx, [rip + 9],jmp\t0x1e5ce1370,nop\tdword ptr [rax],ret\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,jmp\tqword ptr [rax],outsd\tdx, dword ptr [rsi],and\tbyte ptr [rdx + 0x75], ah,imul\tebp, dword ptr [rsp + riz*2 + 0x20], 0x203a4449,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rdata\" is \"0x1dbe00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rdata\" is \"0x1dbe00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"mpclient.dll\" has high imagebase \"0x1e5ce0000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"-azX9FjQj1lWLtG1OIHv/_vO2AqkcX6yAvIJpV8Er/y47SyNXin3GQtjYZCht8/WwdvjBcqhLIPFkoPDxaY\"\" (Indicator: \"Go build ID: \"-azX9FjQj1lWLtG1OIHv/_vO2AqkcX6yAvIJpV8Er/y47SyNXin3GQtjYZCht8/WwdvjBcqhLIPFkoPDxaY\")\" in Source: mpclient.dll","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00006548) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00006548) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 465129)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=ambito.com, O=9YZN7i6axR, L=uBPihe, ST=KY4E9re9V, C=US\" (SHA1: 11:05:65:99:EF:84:F0:4B:84:04:69:F9:F7:80:75:3D:D6:D1:CF:84; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 2288)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\rundll32.exe.mui\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\System32\\CRYPTSP.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"rundll32.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"\n \"rundll32.exe\" trying to touch file \"C:\\mpclient.dll.manifest\"\n \"rundll32.exe\" trying to touch file \"C:\\mpclient.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\mpclient.dll.123.Manifest\"\n \"rundll32.exe\" trying to touch file \"C:\\mpclient.dll.124.Manifest\"\n \"rundll32.exe\" trying to touch file \"C:\\mpclient.dll.2.Manifest\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\rundll32.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\mpclient.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\mpclient.dll.123.Manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\mpclient.dll.124.Manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\mpclient.dll.2.Manifest\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0, Ge\" (Indicator: \"ping \"; Source: \"00000000-00001792.00000000.222831.DDCB0000.00000004.mdmp\")\n Found string \"ping 0, Ge\" (Indicator: \"ping \"; Source: \"00000000-00002072.00000000.223709.2A640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$3e","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"$3f","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"mpclient.dll\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"mpclient.dll\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"WSARecv\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"WSASend\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$41","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$45","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000920.00000001.225281.48C90000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002072.00000001.224454.2A640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://116.202.1.107/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"116.202.1.107\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00001792\"\n YARA signature for PEB traversal process \"00000000-00004412\"\n YARA signature for PEB traversal process \"00000000-00002072\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$46","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"mpclient.dll\")\n Found reference to API \"661,7500,3025,,RtlGetNtProductType,NTDLL.dll,\"00:58:08.953\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp\")\n Found reference to API \"865,5336,3025,,RtlGetNtProductType,NTDLL.dll,\"00:58:25.375\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002072.00000001.224454.2A640000.00000004.mdmp\")\n Found reference to API \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"mpclient.dll\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"mpclient.dll\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"mpclient.dll\"\n Found registry query API: \"RegOpenKey (in long string)\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"\n Found registry query API: \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"\n Found registry query API: \"RegQueryValue (in long string)\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"$48","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"FindNextFile\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"mpclient.dll\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"mpclient.dll\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"mpclient.dll\")\n Found reference to API \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"G_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; File: \"mpclient.dll\")\n Found reference to API \",_InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"mpclient.dll\")\n Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"mpclient.dll\")\n Found reference to API \"G_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000920.00000000.224784.ACA42000.00000002.mdmp\")\n Found reference to API \",_InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000920.00000000.224784.ACA42000.00000002.mdmp\")\n Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000920.00000000.224784.ACA42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; File: \"mpclient.dll\")\n Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00000920.00000000.224784.ACA42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"mpclient.dll\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"mpclient.dll\")\n Found string \"ping 0, Ge\" (Indicator: \"ping\"; Source: \"00000000-00001792.00000000.222831.DDCB0000.00000004.mdmp\")\n Found string \"ping 0, Ge\" (Indicator: \"ping\"; Source: \"00000000-00002072.00000000.223709.2A640000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"route\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"mpclient.dll\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"mpclient.dll\"\n Found registry deletion API: \"sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress %-8s %4d %s\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"SetInformationFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"NtSetInformationFile\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: mpclient.dll\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002072.00000001.224454.AC811000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"mpclient.dll\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"rundll32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\"; Key: \"TS_D45E79EF\"; Value: \"0D15CD8\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"mpclient.dll\")\n file/memory contains long string with (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002072.00000001.224454.AC811000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to disable driver signature enforcement","description":"Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00000920.00000001.225281.48C90000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00001792.00000001.223376.DDCB0000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00002072.00000001.224454.2A640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1553.006","relevance":1,"id":"string-586","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"File has excessive sections (19)\n common in obfuscated files\n Section \".CRT\" has very low entropy (0.26)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":7,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"mpclient.dll\" has section name .rdata with entropy \"7.0224852342698245\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"rundll32.exe\" is setting \"ThreadHideFromDebugger\" data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\rundll32.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$50","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 116.202.1.107 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"$51","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00001792\"\n YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$52","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetUserNameA@ADVAPI32.DLL\" in \"rundll32.exe\"\n \"GetSystemMetrics@USER32.DLL\" in \"rundll32.exe\"\n \"SystemParametersInfoA@USER32.DLL\" in \"rundll32.exe\"\n \"GetWindowTextW@USER32.DLL\" in \"rundll32.exe\"\n \"GetKeyState@USER32.DLL\" in \"rundll32.exe\"\n \"EnumDisplayMonitors@USER32.DLL\" in \"rundll32.exe\"\n \"AdjustTokenPrivileges@ADVAPI32.DLL\" in \"rundll32.exe\"\n \"GetMonitorInfoA@USER32.DLL\" in \"rundll32.exe\"\n \"GetActiveWindow@USER32.DLL\" in \"rundll32.exe\"\n \"SystemParametersInfoW@USER32.DLL\" in \"rundll32.exe\"\n \"EnumWindows@USER32.DLL\" in \"rundll32.exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \"rundll32.exe\"\n \"ExitWindowsEx@USER32.DLL\" in \"rundll32.exe\"\n \"CreateCompatibleBitmap@GDI32.DLL\" in \"rundll32.exe\"\n \"GetDeviceCaps@GDI32.DLL\" in \"rundll32.exe\"\n \"GetMonitorInfoW@USER32.DLL\" in \"rundll32.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"rundll32.exe\"\n \"GetWindowTextA@USER32.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$53","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetThreadContext\n GetSystemInfo\n LoadLibraryW\n GetSystemDirectoryA\n VirtualAlloc\n Sleep\n LoadLibraryExW\n WriteFile\n VirtualProtect\n CreateThread","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"mpclient.dll\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"rundll32.exe\" connects to 116.202.1.107:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$54","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002512.00000000.121552.87790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003836.00000000.120743.9C3F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007420)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":28,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":50,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":50,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Multi-Process","Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"6a3a834f1f12f6b9ab0df15c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Evo","contacted_countries":["DEU"],"submit_name":"e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4.bin","analysis_start_time":"2026-06-23T13:00:00+00:00","indicators_count":{"informative":159,"suspicious":30,"malicious":4},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true},{"id":"6a3a02ec2916f6879509e60b","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Agent.MMK.gen","contacted_countries":["DEU"],"submit_name":"mpclient.dll","analysis_start_time":"2026-06-23T03:52:14+00:00","indicators_count":{"informative":160,"suspicious":31,"malicious":3},"tags":["Multi-Process","Network Traffic","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"116.202.1.107","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]}],"dns_resolutions":null,"http_requests":[{"host":"116.202.1.107","host_ip":"116.202.1.107:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----989375f5740053196784\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0\nContent-Length: 345\nHost: 116.202.1.107","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}],"processes":[{"pid":444,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00000444"},{"pid":8020,"ppid":444,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#10","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00000444","uid":"00000000-00008020"},{"pid":920,"ppid":444,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#11","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00000444","uid":"00000000-00000920"},{"pid":3904,"ppid":444,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#12","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00000444","uid":"00000000-00003904"},{"pid":8776,"ppid":444,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#13","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00000000-00000444","uid":"00000000-00008776"},{"pid":5348,"ppid":8776,"name":"WerFault.exe","command_line":"-u -p 8776 -s 448","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008776","uid":"00000000-00005348"},{"pid":4356,"ppid":8776,"name":"WerFault.exe","command_line":"-u -p 8776 -s 448","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008776","uid":"00000000-00004356"},{"pid":2288,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#2","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002288","icon":"$55"},{"pid":1792,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#3","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001792","icon":"$56"},{"pid":6548,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#1","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00006548","icon":"$57"},{"pid":4412,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#4","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00004412","icon":"$58"},{"pid":7208,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#5","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007208","icon":"$59"},{"pid":2072,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#6","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002072","icon":"$5a"},{"pid":3332,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#7","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003332","icon":"$5b"},{"pid":5676,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#8","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00005676","icon":"$5c"},{"pid":8740,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\mpclient.dll\",#9","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00008740","icon":"$5d"},{"pid":7056,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 8776 -ip 8776","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007056","icon":"$5e"}],"all_imported_dlls":["imagehlp.dll","ws2_32.dll","cryptsp.dll","mpclient.dll","ncryptsslp.dll","crypt32.dll","cryptbase.dll","ntdll.dll","oleaut32.dll","imm32.dll","schannel.dll","KernelBase.dll","msvcrt.dll","ucrtbase.dll","ole32.dll","OnDemandConnRouteHelper.dll","gpapi.dll","dpapi.dll","user32.dll","bcryptprimitives.dll","powrprof.dll","winhttp.dll","IPHLPAPI.DLL","nsi.dll","ntasn1.dll","msasn1.dll","kernel32.dll","fltLib.dll","umpdc.dll","mswsock.dll","rsaenh.dll","SHCore.dll","msvcp_win.dll","VxSSL64.dll","uxtheme.dll","ncrypt.dll","win32u.dll","msctf.dll","bcrypt.dll","webio.dll","rpcrt4.dll","gdi32.dll","gdi32full.dll","advapi32.dll","sechost.dll","shlwapi.dll","winnsi.dll","sspicli.dll","combase.dll","dwmapi.dll","mskeyprotect.dll","winmmbase.dll","e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4.bin.dll","winmm.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"name":"Local\\SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"},{"report_type":"sandbox","report_id":"6a3a834f1f12f6b9ab0df15c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3904:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:3904:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:8776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:2288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:1792:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:6548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:4412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:7208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:2072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:3332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:5676:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]},{"name":"Local\\SM0:8740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a3a02ec2916f6879509e60b"}]}]}},"report_ids":{"sandbox_job_ids":["6a3a834f1f12f6b9ab0df15c","6a3a02ec2916f6879509e60b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample e3133d6068eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e3133d6068eb…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample e3133d6068eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e3133d6068eb…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e3133d6068eba141b3a07adf832a9f6200c116a9dbed925f8db92c5911c908a4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample e3133d6068eb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e3133d6068eb…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]