34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 49:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4e2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample f644c497fa22… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f644c497fa22…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/25 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4"],"about":{"@type":"SoftwareApplication","name":"9ce9db88cedf60a26eaa1a5220aaa9c6.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tb17,"OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF646DCB7B0FD3A96AEE88C64E2D676711FF9D5F") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DF646DCB7B0FD3A96AEE88C64E2D676711FF9D5F") "OneNoteStorageHelper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\F18B538D1BE903B6A6F056435B171589CAF36BF2") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\F18B538D1BE903B6A6F056435B171589CAF36BF2")37:T862,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1111311618 [PID: 6284] "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1111318908 [PID: 6284] "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1111498145 [PID: 6284] "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1111505927 [PID: 6284] "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1111997031 [PID: 6284] "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1112006681 [PID: 6284] "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1112272837 [PID: 6284] "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" queried SystemProcessInformation at 00000000-00006284-00000C15-1112279811 [PID: 6284] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1112875097 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1112882507 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1113034528 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1113041652 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1113518574 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1113535174 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1113761106 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1113768296 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1114074256 [PID: 6468] "OneNoteStorageHelper.exe" queried SystemProcessInformation at 00000000-00006468-00000C15-1114081419 [PID: 6468]38:T2560,Found XOR loop in file "sample.bin" at offset 34604; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 40620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 40905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 85154; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 91719; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 137656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 208480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 529516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 529893; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 557873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 558216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 733198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 782108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 819343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 823883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 833741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 905176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 935456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 976208; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1048857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1077144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1206599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1414211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1496610; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1505660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1523753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1565174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1568873; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1620603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1762967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1909175; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2044845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2076746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2108958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2162086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2236146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2247317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2319614; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2356632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2414506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2515609; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2541229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2556158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2713921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2717883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2740880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2751718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2755862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 15895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 108797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 131715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 192123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 327993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 454437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 461327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 504587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 544535; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 583146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 669812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 736661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 767497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 868001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 869197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 921921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 956676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1046686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1081138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1087429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1174348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1182351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1210328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1219526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1243847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1341880; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1351586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1529007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1588028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1612641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1619360; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1631150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1808813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2035960; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2053449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2082457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2098165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2180045; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2227408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2286211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2324269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2421693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2544904; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2580551; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2594963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2637946; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2642505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2663453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2671249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2708616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2709412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2724255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2737026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2740364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2745953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2789124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2791489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2816293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 91805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 233762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 385844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 409913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 473513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 630325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1605907; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1686338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1721708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1789826; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1958053; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1997239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2051615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2057538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2091726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2177910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2200780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2297673; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2343595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2693912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2766988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2899179; code bytes = 803039:T144e,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000c86efb7f000090fe46000000000088ef1400000000000600000000000000c1da1e97fb7f00000000000000000000000000000000000070ed1400000000000000000000000000c0ec14000000000070d32c97fb7f00000000000000000000f0d22c97fb7f00000800000000000000ca00000000000000000000000000000028ed1400000000000000000100000000e0ec1400000000000000000069002d00f800ac96fb7f000069006e002d0063006f00720065002d00000000000000000080291e97fb7f00000100000065006100640073002d006c0031002d0031002d0093991c97fb7f000000001b97fb7f000008462297fb7f000060934600 (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006284) "OneNoteStorageHelper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000c86efb7f0000200560000000000088ef1400000000000600000000000000c1da1e97fb7f00000000000000000000000000000000000070ed1400000000000000000000000000c0ec14000000000070d32c97fb7f00000000000000000000f0d22c97fb7f0000080000000000000088ed1400000000000000000000000000080000000000000000000001fb7f0000e0ec1400000000000000000069002d00f800ac96fb7f000069006e002d0063006f00720065002d00000000000000000080291e97fb7f00000100000065006100640073002d006c0031002d0031002d0093991c97fb7f000000001b97fb7f000008462297fb7f0000e0066000 (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006468)3a:T56f,"OneNoteStorageHelper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "OneNoteStorageHelper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")3b:T495,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter 43003a00 (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Nvidia (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Nvidia\Windows (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Nvidia\Windows\Config (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Nvidia\Windows\Config\A9CEBF14 (UID: 00000000-00006284)3c:T1c88,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006284) "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006284) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpWebSocketCompleteUpgrade (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpWebSocketSend (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter WinHttpWebSocketReceive (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006468) "OneNoteStorageHelper.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006468)3d:T4e0,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" (Indicator: "user-agent: "; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp")3e:T8dc,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb6ec80000 "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb921e0000 "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" loaded module "KERNEL32.DLL" at base 7ffb96ea0000 "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" loaded module "SHELL32.DLL" at base 7ffb95420000 "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" loaded module "ADVAPI32.DLL" at base 7ffb96f70000 "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" loaded module "NTDLL.DLL" at base 7ffb971b0000 "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffb91d70000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb6ec80000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb921e0000 "OneNoteStorageHelper.exe" loaded module "KERNEL32.DLL" at base 7ffb96ea0000 "OneNoteStorageHelper.exe" loaded module "SHELL32.DLL" at base 7ffb95420000 "OneNoteStorageHelper.exe" loaded module "ADVAPI32.DLL" at base 7ffb96f70000 "OneNoteStorageHelper.exe" loaded module "RPCRT4.DLL" at base 7ffb95e50000 "OneNoteStorageHelper.exe" loaded module "SSPICLI.DLL" at base 7ffb946d0000 "OneNoteStorageHelper.exe" loaded module "WS2_32.DLL" at base 7ffb97070000 "OneNoteStorageHelper.exe" loaded module "WINHTTP.DLL" at base 7ffb8f560000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb7b520000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb93ef0000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb95040000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb8b150000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb8b6b0000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffb93720000 "OneNoteStorageHelper.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffb85890000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb82870000 "OneNoteStorageHelper.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb938100003f:T6fc,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "")40:Tf78,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "9CE9DB88CEDF60A26EAA1A5220AAA9C6"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "30336ED4-E327-447C-9DE0-51B652C86108"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "32980F26-C8F5-5767-6B26-635B3FA83C61"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "")41:T5f8,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\9ce9db88cedf60a26eaa1a5220aaa9c6.exe" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\win32u.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\gdi32.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\user32.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\shell32.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to touch file "C:\Windows\System32\combase.dll"42:T4e0,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to access non-existent file "C:\FLTLIB.DLL" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to access non-existent file "C:\MSVCP140.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to access non-existent file "C:\Wldp.dll" "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" trying to access non-existent file "C:\9ce9db88cedf60a26eaa1a5220aaa9c6.exe" "OneNoteStorageHelper.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Nvidia\Windows\Config\A9CEBF14\FLTLIB.DLL" "OneNoteStorageHelper.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Nvidia\Windows\Config\A9CEBF14\MSVCP140.dll" "OneNoteStorageHelper.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Nvidia\Windows\Config\A9CEBF14\VCRUNTIME140.dll" "OneNoteStorageHelper.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Nvidia\Windows\Config\A9CEBF14\VCRUNTIME140_1.dll"43:Ta0de,Found URL "https://admin.model-point.click/admin.model-point.clickmime" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ey" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnhmenhmen=" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0ep%,)k[p\0" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjroot" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000000.167300.02C40000.00000004.mdmp") Found URL "https://admin.model-point.click/admin.model-point.clickmime" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ey" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnhmenhmen=" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0ep%,)k[p\0" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjroot" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006468.00000001.169217.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000001.169217.02C40000.00000004.mdmp") Found URL "https://admin.model-point.click/admin.model-point.clickmime" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ey" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnhmenhmen=" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0ep%,)k[p\0" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjroot" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006468.00000002.171138.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000002.171138.02C40000.00000004.mdmp") Found URL "https://admin.model-point.click/admin.model-point.clickmime" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ey" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "https://admin.model-point.click/ghfzvrevgnhmenhmen=" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0ep%,)k[p\0" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjroot" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uxr7x%2ftwvfdr4tjocb0sxxl1edvcf55ekiymwxeacv8wiyhk1f2861sky1swmwt177wyllmjjufm%2barcobcvoizlprebhn5ofgl%2bqwavjrizqjpqjmetdcinm7k6g3k3igjhfyqoaqqjaw%3d%3d" - Source: "00000000-00006468.00000003.176530.02C40000.00000004.mdmp")44:T4be,Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp")45:T51d,Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp")46:T6ac,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006284.00000000.167198.00460000.00000004.mdmp, 00000000-00006284.00000000.167198.02450000.00000004.mdmp, 00000000-00006284.00000000.167198.025E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006284.00000000.167198.00460000.00000004.mdmp, 00000000-00006284.00000000.167198.02450000.00000004.mdmp, 00000000-00006284.00000000.167198.025E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006284.00000000.167198.00460000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000000.167300.024F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.024F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.02020000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000000.167300.024F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.024F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.02020000.00000004.mdmp")47:Tc2d,"9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\UCPD"; Key: "SUPPORTEDFEATURES"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "9ce9db88cedf60a26eaa1a5220aaa9c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\NVIDIA\WINDOWS\CONFIG\A9CEBF14\ONENOTESTORAGEHELPER.EXE"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "OneNoteStorageHelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "")48:Tc5b,"OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "OneNoteStorageHelper.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793977897292,"unified_at":"2026-11-06T15:11:37.292Z","metadata":{"hashes":{"sha256":"f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","sha1":"4ca7fa958b3e5450fbac9997921088412b837975","md5":"9ce9db88cedf60a26eaa1a5220aaa9c6","sha512":"0b0d2bff6fef014b08c5f1dee32546362a3387679ebd2a5855a380cbfae8f6616e2f879fb565e79c8d09949d95483829b551073fcd19345a4e149e60cce4919b","ssdeep":"49152:hfBJimt3WVbut909vlU8JNc651YstUQd4NFfER5WhguiHgxPmVfPXnktvCsWmDb:ngVZut9Ud3NJzRCQ6E5Wnx0m/","ssdeep_chunks":["49152:hfBJimt","49152:fBJimt3","49152:BJimt3W","49152:Jimt3WV","49152:imt3WVb","49152:mt3WVbu","49152:t3WVbut","49152:3WVbut9","49152:WVbut90","49152:Vbut909","49152:but909v","49152:ut909vl","49152:t909vlU","49152:909vlU8","49152:09vlU8J","49152:9vlU8JN","49152:vlU8JNc","49152:lU8JNc6","49152:U8JNc65","49152:8JNc651","49152:JNc651Y","49152:Nc651Ys","49152:c651Yst","49152:651YstU","49152:51YstUQ","49152:1YstUQd","49152:YstUQd4","49152:stUQd4N","49152:tUQd4NF","49152:UQd4NFf","49152:Qd4NFfE","49152:d4NFfER","49152:4NFfER5","49152:NFfER5W","49152:FfER5Wh","49152:fER5Whg","49152:ER5Whgu","49152:R5Whgui","49152:5WhguiH","49152:WhguiHg","49152:hguiHgx","49152:guiHgxP","49152:uiHgxPm","49152:iHgxPmV","49152:HgxPmVf","49152:gxPmVfP","49152:xPmVfPX","49152:PmVfPXn","49152:mVfPXnk","49152:VfPXnkt","49152:fPXnktv","49152:PXnktvC","49152:XnktvCs","49152:nktvCsW","49152:ktvCsWm","49152:tvCsWmD","49152:vCsWmDb","98304:hfBJimt","98304:fBJimt3","98304:BJimt3W","98304:Jimt3WV","98304:imt3WVb","98304:mt3WVbu","98304:t3WVbut","98304:3WVbut9","98304:WVbut90","98304:Vbut909","98304:but909v","98304:ut909vl","98304:t909vlU","98304:909vlU8","98304:09vlU8J","98304:9vlU8JN","98304:vlU8JNc","98304:lU8JNc6","98304:U8JNc65","98304:8JNc651","98304:JNc651Y","98304:Nc651Ys","98304:c651Yst","98304:651YstU","98304:51YstUQ","98304:1YstUQd","98304:YstUQd4","98304:stUQd4N","98304:tUQd4NF","98304:UQd4NFf","98304:Qd4NFfE","98304:d4NFfER","98304:4NFfER5","98304:NFfER5W","98304:FfER5Wh","98304:fER5Whg","98304:ER5Whgu","98304:R5Whgui","98304:5WhguiH","98304:WhguiHg","98304:hguiHgx","98304:guiHgxP","98304:uiHgxPm","98304:iHgxPmV","98304:HgxPmVf","98304:gxPmVfP","98304:xPmVfPX","98304:PmVfPXn","98304:mVfPXnk","98304:VfPXnkt","98304:fPXnktv","98304:PXnktvC","98304:XnktvCs","98304:nktvCsW","98304:ktvCsWm","98304:tvCsWmD","98304:vCsWmDb","49152:ngVZut9","49152:gVZut9U","49152:VZut9Ud","49152:Zut9Ud3","49152:ut9Ud3N","49152:t9Ud3NJ","49152:9Ud3NJz","49152:Ud3NJzR","49152:d3NJzRC","49152:3NJzRCQ","49152:NJzRCQ6","49152:JzRCQ6E","49152:zRCQ6E5","49152:RCQ6E5W","49152:CQ6E5Wn","49152:Q6E5Wnx","49152:6E5Wnx0","49152:E5Wnx0m","49152:5Wnx0m/"],"imphash":"11bfa22a68d4b0882c5148c1396d12f4"},"file_info":{"file_name":"9ce9db88cedf60a26eaa1a5220aaa9c6.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2944000,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793856603000,"last_seen":1793877947000,"last_multi_scan":1793877947000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["new_domain","malicious"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":102,"suspicious_count":15,"malicious_count":6,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Packed.VMProtect.AM suspicious application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Execution","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Persistence","technique":"Network Logon Script","attack_id":"T1037.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1037/003","identifiers":[{"type":"informative","value":"Able to establish enduring access through network startup procedures"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Persistence","technique":"Logon Script (Windows)","attack_id":"T1037.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1037/001","identifiers":[{"type":"malicious","value":"Tries to use windows logon scripts to establish persistence"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"PCAP contains base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Process deletes itself"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"zp].bd\", Heuristic match: \"j!.pg\", Heuristic match: \"*i.mn\", Heuristic match: \"d9.kz\", Heuristic match: \"bi:.bn\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp\")\n Found reference to \"wOid8\" (Indicator: \"Oid\"; Source: \"00000000-00006468.00000000.167300.00B80000.00000002.mdmp, 00000000-00006468.00000001.169217.00B80000.00000002.mdmp, 00000000-00006468.00000002.171138.00B80000.00000002.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006468.00000000.167300.02C40000.00000004.mdmp, 00000000-00006468.00000001.169217.02C40000.00000004.mdmp, 00000000-00006468.00000002.171138.02C40000.00000004.mdmp, 00000000-00006468.00000003.176530.02C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"OneNoteStorageHelper.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"OneNoteStorageHelper.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$36","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"PCAP contains base64 strings","description":"Contains base64 encoded string \"SrEyYJ6Awb2MTiiaf3G5wA==\" in [Source : PCAP]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$37","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" renamed original file\"C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" to \":exi\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".6\\/\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006284.00000000.167198.00460000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00006284.00000000.167198.00460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006284.00000000.167198.00460000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"like\" in header \"GET /ghfzvrevgn HTTP/1.1Connection: UpgradeUpgrade: websocketUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36Sec-WebSocket-Key: SrEyYJ6Awb2MTiiaf3G5wA==Sec-WebSocket-Version: 13Host: admin.model-point.click\"\n Contains base64 string in header \"SrEyYJ6Awb2MTiiaf3G5wA==\" in header \"GET /ghfzvrevgn HTTP/1.1Connection: UpgradeUpgrade: websocketUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36Sec-WebSocket-Key: SrEyYJ6Awb2MTiiaf3G5wA==Sec-WebSocket-Version: 13Host: admin.model-point.click\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.94963","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: PCAP contains base64 strings\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$38","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameA\" (Source: \"00000000-00006284.00000000.167198.00460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationA\" in file \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationA\" in \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006284)\n \"OneNoteStorageHelper.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006284)\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006284)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006284)\n \"OneNoteStorageHelper.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006284)\n \"OneNoteStorageHelper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"OneNoteStorageHelper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"OneNoteStorageHelper.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"OneNoteStorageHelper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" queried token user identity (UID: 00000000-00006284)\n \"OneNoteStorageHelper.exe\" queried token user identity (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"OneNoteStorageHelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"OneNoteStorageHelper.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"CopyFileW\" to copy C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe to new location %LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe (UID: 00000000-00006284)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\"\" - (UID: 00000000-00006284)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00006284)\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00006284)\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00006284)\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00006284)\n \"OneNoteStorageHelper.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00006468)\n \"OneNoteStorageHelper.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00006468)\n \"OneNoteStorageHelper.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00006468)\n \"OneNoteStorageHelper.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00006468)\n \"OneNoteStorageHelper.exe\" called \"LoadLibrary\" with a parameter winhttp.dll (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"admin.model-point.click\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.179.235:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00006284.00000000.167198.40010000.00000020.mdmp\n \"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00006284.00000000.167198.40010000.00000020.mdmp\n \"Y\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00006284.00000000.167198.00460000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 9ce9db88cedf60a26eaa1a5220aaa9c6.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6284:304:WilStaging_02\"\n Process 9ce9db88cedf60a26eaa1a5220aaa9c6.exe created mutex with name \"\\BaseNamedObjects\\B8561120273C3BA8\"\n Process 9ce9db88cedf60a26eaa1a5220aaa9c6.exe created mutex with name \"SM0:6284:304:WilStaging_02\"\n Process OneNoteStorageHelper.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6468:304:WilStaging_02\"\n Process OneNoteStorageHelper.exe created mutex with name \"\\BaseNamedObjects\\B8561120273C3BA8\"\n Process OneNoteStorageHelper.exe created mutex with name \"SM0:6468:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Y\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00006284.00000000.167198.00460000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00006284.00000000.167198.40010000.00000020.mdmp\n \"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00006284.00000000.167198.40010000.00000020.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET /ghfzvrevgn HTTP/1.1\nConnection: Upgrade\nUpgrade: websocket\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\nSec-WebSocket-Key: SrEyYJ6Awb2MTiiaf3G5wA==\nSec-WebSocket-Version: 13\nHost: admin.model-point.click\" Response ==> HTTP/1.1 101 Switching Protocols\nDate: Thu\n 05 Nov 2026 11:27:14 GMT\nConnection: upgrade\nUpgrade: websocket\nSec-WebSocket-Accept: CmQ18TP0iLK+SXwALUdku0xK+Js=\ncf-cache-status: DYNAMIC\nServer-Timing: cfCacheStatus;desc=\"DYNAMIC\"\nServer-Timing: cfEdge;dur=16\ncfOrigin;dur=22\nReport-To: {\"group\":\"cf-nel\"\n\"max_age\":604800\n\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UXR7X%2FTwvFDr4TJoCb0SxXl1edVcf55EKiYMWXeAcV8wIYHK1F2861sky1SWMwT177wYllmJjUfm%2BARcobCVoIzLprEbhn5OFGl%2BQwavJrIZQJpQjMetdCiNM7K6g3k3iGjHfyQoaqQJAw%3D%3D\"}]}\nNel: {\"report_to\":\"cf-nel\"\n\"success_fraction\":0.0\n\"max_age\":604800}\nServer: cloudflare\nCF-RAY: a55b82123a4e41ce-SJC\nalt-svc: h3=\":443\"; ma=86400 with no response body","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 94840000\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 95040000\n \"OneNoteStorageHelper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 94840000\n \"OneNoteStorageHelper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 95040000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95E50000\n \"OneNoteStorageHelper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95E50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" was detected as \"VMProtect\" and name: \"Protector\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has an executable section named \".text\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has an executable section named \".6\\/\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has an executable section named \".W%q\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has an writable section named \".data\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has an writable section named \".g^H\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" file has an entrypoint instructions - \"call\t0x1403fe98a,ret\t,cmp\teax, 0x5039de7d,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".W%q\" is \"0x2ce600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".6\\/\" is \"0x1af878\" greater than 0x100000\n Virtual size of \".W%q\" is \"0x2ce508\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"OneNoteStorageHelper.exe\" (UID: 00000000-00006468) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"OneNoteStorageHelper.exe\" (UID: 00000000-00006468) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"admin.model-point.click\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"OneNoteStorageHelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"OneNoteStorageHelper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"OneNoteStorageHelper.exe\" (UID: 00000000-00006468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"OneNoteStorageHelper.exe\" (UID: 00000000-00006468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=YE2, O=Let's Encrypt, C=US\" (SHA1: 62:DD:FF:80:B8:8F:12:D3:CA:6B:A4:4E:B0:9B:5E:7B:A9:E2:F3:90; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Root YE, O=ISRG, C=US\" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X2, O=Internet Security Research Group, C=US\" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish enduring access through network startup procedures","description":"Found string \"UserInitMprLogonScript\" (Indicator: \"userinitmprlogonscript\"; Source: \"00000000-00006284-00000BC1-1112492068\")","origin":"File/Memory","mitre_attack_id":"T1037.003","relevance":1,"id":"string-716","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"OneNoteStorageHelper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" queries basic process information of the \"C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (UID: 6284)\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\" (UID: 6284)\n \"OneNoteStorageHelper.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\" (UID: 6468)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"OneNoteStorageHelper.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" reads file \"c:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" reads file \"c:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe:zone.identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping multiple times\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe:Zone.Identifier\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" touched file \"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\"\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" touched file \"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"OneNoteStorageHelper.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}\"\n \"OneNoteStorageHelper.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\nvidia\\windows\\config\\a9cebf14\\onenotestoragehelper.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"OneNoteStorageHelper.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"64f890\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"OneNoteStorageHelper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"64f890\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /ghfzvrevgn\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006468-00000C2C-1114030083\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006468-00000C2C-1114169814\")\n Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00006468-00000C2C-1114211684\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00006468-00000C2C-1114211805\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006468-00000C2C-1114211805\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"00000000-00006468-00000C2C-1114211805\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00006468-00000C2C-1114211969\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00006468-00000C2C-1114211969\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006468-00000C2C-1114030083\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /ghfzvrevgn HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006468.00000000.167300.005F0000.00000004.mdmp, 00000000-00006468.00000001.169217.005F0000.00000004.mdmp, 00000000-00006468.00000002.171138.005F0000.00000004.mdmp, 00000000-00006468.00000003.176530.005F0000.00000004.mdmp\")\n Found string \"/crl/prHTTP/1.1 101 Switching Protocols\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006468.00000000.167300.02C40000.00000004.mdmp, 00000000-00006468.00000001.169217.02C40000.00000004.mdmp, 00000000-00006468.00000002.171138.02C40000.00000004.mdmp, 00000000-00006468.00000003.176530.02C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /ghfzvrevgn HTTP/1.1\nConnection: Upgrade\nUpgrade: websocket\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\nSec-WebSocket-Key: SrEyYJ6Awb2MTiiaf3G5wA==\nSec-WebSocket-Version: 13\nHost: admin.model-point.click\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"admin.model-point.click\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://admin.model-point.click/ghfzvrevgn","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"admin.model-point.click\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.179.235\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$44","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OneNoteStorageHelper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"OneNoteStorageHelper.exe\" called \"GetComputerNameW\" (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"OneNoteStorageHelper.exe\" called \"GetUserNameW\" (UID: 00000000-00006468)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$46","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006284.00000000.167198.40010000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"OneNoteStorageHelper.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" opened \"\\Device\\KsecDD\"\n \"OneNoteStorageHelper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\ENVIRONMENT\"; Key: \"USERINITMPRLOGONSCRIPT\"; Value: \"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006468.00000000.167300.02C40000.00000004.mdmp, 00000000-00006468.00000001.169217.02C40000.00000004.mdmp, 00000000-00006468.00000002.171138.02C40000.00000004.mdmp, 00000000-00006468.00000003.176530.02C40000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" has zero raw size but 47020 bytes virtual size\n possible runtime unpacking/injection\n Section \".6\\/\" has zero raw size but 1767544 bytes virtual size\n possible runtime unpacking/injection\n Section \".g^H\" has very low entropy (0.36)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Process deletes itself","description":"\"C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\ENVIRONMENT\"; Key: \"USERINITMPRLOGONSCRIPT\"; Value: \"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has section name .W%q with entropy \"7.950770688432636\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping multiple times","description":"\"OneNoteStorageHelper.exe\" (Thread ID: 3624) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/24 Antivirus vendors marked sample as malicious (16% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.179.235 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" marked \"C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" opened \"C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$48","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" has an entrypoint in section \".W%q\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"malicious","category":"Installation/Persistence","name":"Tries to use windows logon scripts to establish persistence","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" (Path: \"HKCU\\ENVIRONMENT\"; Key: \"USERINITMPRLOGONSCRIPT\"; Value: \"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\")","origin":"Registry Access","mitre_attack_id":"T1037.001","relevance":7,"id":"registry-90","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\" (Handle: 572)\n \"9ce9db88cedf60a26eaa1a5220aaa9c6.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe\" (Handle: 572)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"model-point.click\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Tries to use windows logon scripts to establish persistence"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}],"intel_graph":{"map":{"Domain:admin.model-point.click":{"type":"Domain","value":"admin.model-point.click"},"File:f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4":{"type":"File","value":"f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4"},"Ip:172.67.179.235":{"type":"Ip","value":"172.67.179.235"},"Url:/ghfzvrevgn":{"type":"Url","value":"/ghfzvrevgn"}},"chains":[{"id":"sandbox_network","root":"File:f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","edges":[{"edge_kind":"contacted_ip","from_key":"File:f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","to_key":"Ip:172.67.179.235"},{"edge_kind":"contacted_domain","from_key":"File:f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","to_key":"Domain:admin.model-point.click"},{"edge_kind":"resolves_to","from_key":"Domain:admin.model-point.click","to_key":"Ip:172.67.179.235"},{"edge_kind":"contacted_url","from_key":"File:f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","to_key":"Url:/ghfzvrevgn"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["new_domain","malicious"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"6aec67ba1d21e293f90c9041","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Evo","contacted_countries":["USA"],"submit_name":"9ce9db88cedf60a26eaa1a5220aaa9c6.exe","analysis_start_time":"2026-11-05T11:25:48+00:00","indicators_count":{"informative":102,"suspicious":31,"malicious":4},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.179.235","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}],"dns_resolutions":[{"domain":"admin.model-point.click","address":"172.67.179.235","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}],"http_requests":[{"host":"admin.model-point.click","host_ip":"172.67.179.235:443","url":"/ghfzvrevgn","method":"GET","response_code":"101","response_phrase":"Switching Protocols","header":"GET /ghfzvrevgn HTTP/1.1\nConnection: Upgrade\nUpgrade: websocket\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\nSec-WebSocket-Key: SrEyYJ6Awb2MTiiaf3G5wA==\nSec-WebSocket-Version: 13\nHost: admin.model-point.click","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}],"processes":[{"pid":6284,"ppid":0,"name":"9ce9db88cedf60a26eaa1a5220aaa9c6.exe","command_line":"","sha256":"f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","normalized_path":"C:\\9ce9db88cedf60a26eaa1a5220aaa9c6.exe","uid":"00000000-00006284","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":6468,"ppid":6284,"name":"OneNoteStorageHelper.exe","command_line":"","sha256":"f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4","normalized_path":"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe","parent_uid":"00000000-00006284","uid":"00000000-00006468"}],"all_imported_dlls":["vcruntime140.dll","bcryptprimitives.dll","nsi.dll","ntasn1.dll","ncryptsslp.dll","ntdll.dll","windows.storage.dll","OnDemandConnRouteHelper.dll","IPHLPAPI.DLL","shlwapi.dll","mskeyprotect.dll","shell32.dll","ole32.dll","combase.dll","SHCore.dll","winhttp.dll","Websocket.dll","wldp.dll","webio.dll","schannel.dll","ncrypt.dll","cryptbase.dll","win32u.dll","gdi32.dll","dhcpcsvc.dll","dnsapi.dll","rsaenh.dll","gdi32full.dll","gpapi.dll","msasn1.dll","bcrypt.dll","user32.dll","msvcp_win.dll","VxSSL64.dll","ws2_32.dll","msvcp140.dll","FWPUCLNT.DLL","ntmarta.dll","winnsi.dll","advapi32.dll","oleaut32.dll","dhcpcsvc6.dll","kernel32.dll","ucrtbase.dll","imm32.dll","fltLib.dll","vcruntime140_1.dll","sechost.dll","uxtheme.dll","mswsock.dll","KernelBase.dll","cryptsp.dll","dpapi.dll","apphelp.dll","rpcrt4.dll","msvcrt.dll","sspicli.dll","rasadhlp.dll","crypt32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"%LOCALAPPDATA%\\Nvidia\\Windows\\Config\\A9CEBF14\\OneNoteStorageHelper.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"name":"\\BaseNamedObjects\\B8561120273C3BA8","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"name":"SM0:6284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]},{"name":"SM0:6468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aec67ba1d21e293f90c9041"}]}]}},"report_ids":{"sandbox_job_ids":["6aec67ba1d21e293f90c9041"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample f644c497fa22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f644c497fa22…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/25 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample f644c497fa22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f644c497fa22…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/25 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f644c497fa22d31067e10d96d8fdfd8937d8ebb0bc6cd464cf1cacf63c5a81a4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample f644c497fa22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f644c497fa22…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/25 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L49","11",{}]] 32:null