24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 012063e0b7b4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 012063e0b7b4…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240"],"about":{"@type":"SoftwareApplication","name":"1.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc6c,"1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000001fb2ee08c8d400000800000000000000ffffffffffffffff3400000000000000d6002413fc7f0000c8e7dff651000000db04601dfc7f000000000000fc7f00002a965e1afc7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000030e8dff6510000000800000000000000000000000000000000000000000000008f4cee08c8d40000c3f05e1dfc7f00000000a61bfc7f0000a7135f1dfc7f000088e8dff6 (UID: 00000000-00007528) "1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007528) "1.exe" called "RtlGetVersion" (UID: 00000000-00007528) "1.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007528) "1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac541cfc7f0000000000000000000051ed621dfc7f0000000000006f0100000000000000000000955bdd54ef0800002a000000000000003045de546f0100008fec621dfc7f0000e0ac541cfc7f0000e0ac541cfc7f0000000000000000000000000000fc7f0000ffffff7f47bc000000000000000000000000000000000000d8ce481cfc7f00002a0000000000000069c3011cfc7f00003100000000000000f002000000000000f402000000000000110001100000000040cedff65100000003a33c1dfc7f000040cedff65100000000000000000000002b00000000000000000000000000000020b0071cfc7f0000b43f061cfc7f0000e0ce481c (UID: 00000000-00007528) "1.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007528)26:T991,"1.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "NAMESERVER"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")27:T43b,"1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\162797d679096999.automaticDestinations-ms" "1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms" "1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b6ebacd7cd2f25a.automaticDestinations-ms" "1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1bc9bbbe61f14501.automaticDestinations-ms" "1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\319f01bf9fe00f2d.automaticDestinations-ms" "1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\40bea8205f2601fe.automaticDestinations-ms" "1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5175b273ceba776b.automaticDestinations-ms"28:T922,"1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")29:T4b1,"1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2a:T1bdc,"1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007528) "1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00007528)2b:T671a,"1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter deflateInit2_ (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter deflate (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter deflateEnd (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter inflateInit2_ (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter inflate (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter inflateEnd (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter zlibCompileFlags (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00007528) "1.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007528)2c:T40f6,"CREATE TABLE keywords (id INTEGER PRIMARY KEY,short_name VARCHAR NOT NULL,keyword VARCHAR NOT NULL,favicon_url VARCHAR NOT NULL,url VARCHAR NOT NULL,safe_for_autoreplace INTEGER,originating_url VARCHAR,date_created INTEGER DEFAULT 0,usage_count INTEGER DEFAULT 0,input_encodings VARCHAR,suggest_url VARCHAR,prepopulate_id INTEGER DEFAULT 0,created_by_policy INTEGER DEFAULT 0,last_modified INTEGER DEFAULT 0,sync_guid VARCHAR,alternate_urls VARCHAR,image_url VARCHAR,search_url_post_params VARCHAR,suggest_url_post_params VARCHAR,image_url_post_params VARCHAR,new_tab_url VARCHAR,last_visited INTEGER DEFAULT 0, created_from_play_api INTEGER DEFAULT 0, is_active INTEGER DEFAULT 0, starter_pack_id INTEGER DEFAULT 0)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table keywords (id integer primary key,short_name varchar not null,keyword varchar not null,favicon_url varchar not null,url varchar not null,safe_for_autoreplace integer,originating_url varchar,date_created integer default 0,usage_count integer default 0,input_encodings varchar,suggest_url varchar,prepopulate_id integer default 0,created_by_policy integer default 0,last_modified integer default 0,sync_guid varchar,alternate_urls varchar,image_url varchar,search_url_post_params varchar,suggest_url_post_params varchar,image_url_post_params varchar,new_tab_url varchar,last_visited integer default 0, created_from_play_api integer default 0, is_active integer default 0, starter_pack_id integer default 0)"), "CREATE TABLE credit_cards ( guid VARCHAR PRIMARY KEY, name_on_card VARCHAR, expiration_month INTEGER, expiration_year INTEGER, card_number_encrypted BLOB, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR, nickname VARCHAR)t" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table credit_cards ( guid varchar primary key, name_on_card varchar, expiration_month integer, expiration_year integer, card_number_encrypted blob, date_modified integer not null default 0, origin varchar default '', use_count integer not null default 0, use_date integer not null default 0, billing_address_id varchar, nickname varchar)t"), "CREATE TABLE autofill (name VARCHAR, value VARCHAR, value_lower VARCHAR, date_created INTEGER DEFAULT 0, date_last_used INTEGER DEFAULT 0, count INTEGER DEFAULT 1, PRIMARY KEY (name, value))}" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill (name varchar, value varchar, value_lower varchar, date_created integer default 0, date_last_used integer default 0, count integer default 1, primary key (name, value))}"), "CREATE TABLE token_service (service VARCHAR PRIMARY KEY NOT NULL,encrypted_token BLOB)9" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table token_service (service varchar primary key not null,encrypted_token blob)9"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'"), "CREATE TABLE autofill_profile_addresses ( guid VARCHAR, street_address VARCHAR, street_name VARCHAR, dependent_street_name VARCHAR, house_number VARCHAR, subpremise VARCHAR, premise_name VARCHAR, street_address_status INTEGER DEFAULT 0, street_name_status INTEGER DEFAULT 0, dependent_street_name_status INTEGER DEFAULT 0, house_number_status INTEGER DEFAULT 0, subpremise_status INTEGER DEFAULT 0, premise_name_status INTEGER DEFAULT 0, dependent_locality VARCHAR, city VARCHAR, state VARCHAR, zip_code VARCHAR, sorting_code VARCHAR, country_code VARCHAR, dependent_locality_status INTEGER DEFAULT 0, city_status INTEGER DEFAULT 0, state_status INTEGER DEFAULT 0, zip_code_status INTEGER DEFAULT 0, sorting_code_status INTEGER DEFAULT 0, country_code_status INTEGER DEFAULT 0, apartment_number VARCHAR, floor VARCHAR, apartment_number_status INTEGER DEFAULT 0, floor_status INTEGER DEFAULT 0)A" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill_profile_addresses ( guid varchar, street_address varchar, street_name varchar, dependent_street_name varchar, house_number varchar, subpremise varchar, premise_name varchar, street_address_status integer default 0, street_name_status integer default 0, dependent_street_name_status integer default 0, house_number_status integer default 0, subpremise_status integer default 0, premise_name_status integer default 0, dependent_locality varchar, city varchar, state varchar, zip_code varchar, sorting_code varchar, country_code varchar, dependent_locality_status integer default 0, city_status integer default 0, state_status integer default 0, zip_code_status integer default 0, sorting_code_status integer default 0, country_code_status integer default 0, apartment_number varchar, floor varchar, apartment_number_status integer default 0, floor_status integer default 0)a"), "CREATE TABLE autofill_profiles ( guid VARCHAR PRIMARY KEY, company_name VARCHAR, street_address VARCHAR, dependent_locality VARCHAR, city VARCHAR, state VARCHAR, zipcode VARCHAR, sorting_code VARCHAR, country_code VARCHAR, date_modified INTEGER NOT NULL DEFAULT 0, origin VARCHAR DEFAULT '', language_code VARCHAR, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, label VARCHAR, disallow_settings_visible_updates INTEGER NOT NULL DEFAULT 0)7" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill_profiles ( guid varchar primary key, company_name varchar, street_address varchar, dependent_locality varchar, city varchar, state varchar, zipcode varchar, sorting_code varchar, country_code varchar, date_modified integer not null default 0, origin varchar default '', language_code varchar, use_count integer not null default 0, use_date integer not null default 0, label varchar, disallow_settings_visible_updates integer not null default 0)7"), "CREATE TABLE masked_credit_cards (id VARCHAR,name_on_card VARCHAR,network VARCHAR,last_four VARCHAR,exp_month INTEGER DEFAULT 0,exp_year INTEGER DEFAULT 0, bank_name VARCHAR, nickname VARCHAR, card_issuer INTEGER DEFAULT 0, instrument_id INTEGER DEFAULT 0, virtual_card_enrollment_state INTEGER DEFAULT 0, card_art_url VARCHAR, product_description VARCHAR)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table masked_credit_cards (id varchar,name_on_card varchar,network varchar,last_four varchar,exp_month integer default 0,exp_year integer default 0, bank_name varchar, nickname varchar, card_issuer integer default 0, instrument_id integer default 0, virtual_card_enrollment_state integer default 0, card_art_url varchar, product_description varchar)"), "CREATE TABLE server_card_metadata (id VARCHAR NOT NULL,use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, billing_address_id VARCHAR)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table server_card_metadata (id varchar not null,use_count integer not null default 0, use_date integer not null default 0, billing_address_id varchar)"), "CREATE TABLE unmasked_credit_cards (id VARCHAR,card_number_encrypted VARCHAR,unmask_date INTEGER NOT NULL DEFAULT 0)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table unmasked_credit_cards (id varchar,card_number_encrypted varchar,unmask_date integer not null default 0)"), "CREATE TABLE autofill_profile_phones ( guid VARCHAR, number VARCHAR)~" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill_profile_phones ( guid varchar, number varchar)~"), "CREATE TABLE autofill_profile_emails ( guid VARCHAR, email VARCHAR)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill_profile_emails ( guid varchar, email varchar)"), "CREATE TABLE autofill_profile_names ( guid VARCHAR, first_name VARCHAR, middle_name VARCHAR, last_name VARCHAR, full_name VARCHAR, honorific_prefix VARCHAR, first_last_name VARCHAR, conjunction_last_name VARCHAR, second_last_name VARCHAR, honorific_prefix_status INTEGER DEFAULT 0, first_name_status INTEGER DEFAULT 0, middle_name_status INTEGER DEFAULT 0, last_name_status INTEGER DEFAULT 0, first_last_name_status INTEGER DEFAULT 0, conjunction_last_name_status INTEGER DEFAULT 0, second_last_name_status INTEGER DEFAULT 0, full_name_status INTEGER DEFAULT 0, full_name_with_honorific_prefix VARCHAR, full_name_with_honorific_prefix_status INTEGER DEFAULT 0)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill_profile_names ( guid varchar, first_name varchar, middle_name varchar, last_name varchar, full_name varchar, honorific_prefix varchar, first_last_name varchar, conjunction_last_name varchar, second_last_name varchar, honorific_prefix_status integer default 0, first_name_status integer default 0, middle_name_status integer default 0, last_name_status integer default 0, first_last_name_status integer default 0, conjunction_last_name_status integer default 0, second_last_name_status integer default 0, full_name_status integer default 0, full_name_with_honorific_prefix varchar, full_name_with_honorific_prefix_status integer default 0)"), "CREATE TABLE payments_customer_data (customer_id VARCHAR)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table payments_customer_data (customer_id varchar)"), "CREATE TABLE autofill_model_type_state (model_type INTEGER NOT NULL PRIMARY KEY, value BLOB)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill_model_type_state (model_type integer not null primary key, value blob)"), "CREATE TABLE autofill_sync_metadata (model_type INTEGER NOT NULL, storage_key VARCHAR NOT NULL, value BLOB, PRIMARY KEY (model_type, storage_key))K" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table autofill_sync_metadata (model_type integer not null, storage_key varchar not null, value blob, primary key (model_type, storage_key))k"), "CREATE TABLE server_address_metadata (id VARCHAR NOT NULL,use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, has_converted BOOL NOT NULL DEFAULT FALSE)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table server_address_metadata (id varchar not null,use_count integer not null default 0, use_date integer not null default 0, has_converted bool not null default false)"), "CREATE TABLE server_addresses (id VARCHAR,company_name VARCHAR,street_address VARCHAR,address_1 VARCHAR,address_2 VARCHAR,address_3 VARCHAR,address_4 VARCHAR,postal_code VARCHAR,sorting_code VARCHAR,country_code VARCHAR,language_code VARCHAR, recipient_name VARCHAR, phone_number VARCHAR)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table server_addresses (id varchar,company_name varchar,street_address varchar,address_1 varchar,address_2 varchar,address_3 varchar,address_4 varchar,postal_code varchar,sorting_code varchar,country_code varchar,language_code varchar, recipient_name varchar, phone_number varchar)"), "CREATE TABLE segments (id INTEGER PRIMARY KEY,name VARCHAR,url_id INTEGER NON NULL)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table segments (id integer primary key,name varchar,url_id integer non null)"), "CREATE TABLE downloads_reroute_info (download_id INTEGER NOT NULL,reroute_info_serialized VARCHAR NOT NULL,PRIMARY KEY (download_id) )?" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table downloads_reroute_info (download_id integer not null,reroute_info_serialized varchar not null,primary key (download_id) )?"), "CREATE TABLE downloads (id INTEGER PRIMARY KEY,guid VARCHAR NOT NULL,current_path LONGVARCHAR NOT NULL,target_path LONGVARCHAR NOT NULL,start_time INTEGER NOT NULL,received_bytes INTEGER NOT NULL,total_bytes INTEGER NOT NULL,state INTEGER NOT NULL,danger_type INTEGER NOT NULL,interrupt_reason INTEGER NOT NULL,hash BLOB NOT NULL,end_time INTEGER NOT NULL,opened INTEGER NOT NULL,last_access_time INTEGER NOT NULL,transient INTEGER NOT NULL,referrer VARCHAR NOT NULL,site_url VARCHAR NOT NULL,embedder_download_data VARCHAR NOT NULL,tab_url VARCHAR NOT NULL,tab_referrer_url VARCHAR NOT NULL,http_method VARCHAR NOT NULL,by_ext_id VARCHAR NOT NULL,by_ext_name VARCHAR NOT NULL,etag VARCHAR NOT NULL,last_modified VARCHAR NOT NULL,mime_type VARCHAR(255) NOT NULL original_mime_type VARCHAR(255) NOT NULL)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table downloads (id integer primary key,guid varchar not null,current_path longvarchar not null,target_path longvarchar not null,start_time integer not null,received_bytes integer not null,total_bytes integer not null,state integer not null,danger_type integer not null,interrupt_reason integer not null,hash blob not null,end_time integer not null,opened integer not null,last_access_time integer not null,transient integer not null,referrer varchar not null,site_url varchar not null,embedder_download_data varchar not null,tab_url varchar not null,tab_referrer_url varchar not null,http_method varchar not null,by_ext_id varchar not null,by_ext_name varchar not null,etag varchar not null,last_modified varchar not null,mime_type varchar(255) not null original_mime_type varchar(255) not null)"), "CREATE TABLE keyword_search_terms (keyword_id INTEGER NOT NULL,url_id INTEGER NOT NULL,term LONGVARCHAR NOT NULL,normalized_term LONGVARCHAR NOT NULL)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table keyword_search_terms (keyword_id integer not null,url_id integer not null,term longvarchar not null,normalized_term longvarchar not null)"), "CREATE TABLE downloads_url_chains (id INTEGER NOT NULL,chain_index INTEGER NOT NULL,url LONGVARCHAR NOT NULL, PRIMARY KEY (id, chain_index) )n" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table downloads_url_chains (id integer not null,chain_index integer not null,url longvarchar not null, primary key (id, chain_index) )n"), "CREATE TABLE visit_source(id INTEGER PRIMARY KEY,source INTEGER NOT NULL)" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table visit_source(id integer primary key,source integer not null)"), "CREATE TABLE downloads_slices (download_id INTEGER NOT NULL,offset INTEGER NOT NULL,received_bytes INTEGER NOT NULL,finished INTEGER NOT NULL DEFAULT 0,PRIMARY KEY (download_id, offset) )G" (Source: 00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp, Indicator: "create table downloads_slices (download_id integer not null,offset integer not null,received_bytes integer not null,finished integer not null default 0,primary key (download_id, offset) )g")2d:T50c,Found reference to API (Indicator: "GetFileSize"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found reference to API (Indicator: "Sleep"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found reference to API (Indicator: "MessageBox"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00007528.00000000.77233.FF140000.00000002.mdmp, 00000000-00007528.00000001.79156.FF140000.00000002.mdmp, 00000000-00007528.00000002.81073.FF140000.00000002.mdmp")2e:T1422,"Software\Microsoft\Windows\ShellNoRoam\MUICache" in Source: lnbc0jefdb4.txt "Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" in Source: lnbc0jefdb4.txt "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" in Source: lnbc0jefdb4.txt "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" in Source: 00000000-00007528-00000C94-17559264 "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00007528.00000000.77233.54D40000.00000004.mdmp "Y\MACHINE\Software\Microsoft" in Source: 00000000-00007528.00000000.77233.54D40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ti" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007528.00000000.77233.FF140000.00000002.mdmp 00000000-00007528.00000001.79156.FF140000.00000002.mdmp 00000000-00007528.00000002.81073.FF140000.00000002.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007528.00000001.79156.9AF20000.00000004.mdmp 00000000-00007528.00000002.81073.9AF20000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007528.00000001.79156.9AF20000.00000004.mdmp 00000000-00007528.00000002.81073.9AF20000.00000004.mdmp2f:T7ab,"1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]30:T409e,"C:\ Drive type : Fixed Volumn label : File system : NTFS Total size of drive : 100.0 GB Total available space : 36.68 GB Available space to current user : 36.68 GBD:\ Drive type : CDRomZ:\ Drive type : Fixed Volumn label : File system : NTFS Total size of drive : 100.0 GB Total available space : 36.68 GB Available space to current user : 36.68 GBC:\ $Recycle.Bin - - 3/5/2018 1:59:01 AM S-1-5-18 - - 3/5/2018 1:59:01 AM S-1-5-21-735145574-3570218355-1207367261-1001 - - 11/9/2022 2:01:56 PM $WINDOWS.~BT - - 6/15/2018 2:37:48 AM DUDownload - - 6/15/2018 2:37:48 AM Sources - - 1/29/2019 7:05:04 AM Documents and Settings - - 7/10/2015 5:21:38 AM found.000 - - 11/10/2020 11:23:14 PM dir0000.chk - - 7/16/2018 2:09:51 AM dir0001.chk - - 7/16/2018 2:09:52 AM dir0002.chk - - 7/16/2018 2:09:53 AM dir0003.chk - - 7/16/2018 2:09:53 AM dir0004.chk - - 7/16/2018 2:09:53 AM dir0005.chk - - 7/16/2018 2:09:53 AM dir0006.chk - - 7/16/2018 2:09:53 AM dir0007.chk - - 7/16/2018 2:09:53 AM dir0008.chk - - 7/16/2018 2:09:53 AM dir0009.chk - - 7/16/2018 2:09:53 AM dir0010.chk - - 7/16/2018 2:09:53 AM dir0011.chk - - 7/16/2018 2:09:53 AM dir0012.chk - - 7/16/2018 2:09:53 AM file00000003.chk - 2.0 KB - 7/1/2018 11:00:43 PM MSOCache - - 3/22/2022 9:03:45 AM All Users - - 3/22/2022 9:03:52 AM PerfLogs - - 3/6/2018 12:57:45 AM Admin - - 3/6/2018 12:57:45 AM Program Files - - 11/9/2022 1:54:20 PM Common Files - - 3/22/2022 9:06:06 AM internet explorer - - 9/29/2017 7:41:24 AM KMSpico - - 7/17/2018 5:25:53 AM Microsoft - - 6/28/2022 5:43:35 AM Microsoft Analysis Services - - 3/22/2022 9:03:58 AM Microsoft Office - - 3/22/2022 9:05:43 AM Microsoft Sync Framework - - 3/22/2022 9:05:42 AM mitmproxy - - 11/9/2022 1:54:23 PM MSBuild - - 10/7/2022 11:04:41 AM Npcap - - 11/9/2022 1:51:30 PM Oracle - - 3/5/2018 1:47:14 PM Reference Assemblies - - 10/7/2022 11:04:41 AM rempl - - 1/29/2019 3:00:20 PM Uninstall Information - - 7/10/2015 5:21:54 AM Windows Defender - - 3/6/2018 12:57:46 AM Windows Defender Advanced Threat Protection - - 3/6/2018 12:57:46 AM Windows Mail - - 3/5/2018 1:36:04 AM Windows Media Player - - 9/29/2017 7:41:29 AM Windows Multimedia Platform - - 9/29/2017 6:46:37 AM windows nt - - 9/29/2017 6:46:33 AM Windows Photo Viewer - - 9/29/2017 7:41:05 AM Windows Portable Devices - - 9/29/2017 6:46:37 AM Windows Security - - 9/29/2017 6:46:33 AM Windows Sidebar - - 9/29/2017 6:46:33 AM WindowsApps - - 11/12/2020 11:22:20 AM WindowsPowerShell - - 9/29/2017 6:46:33 AM Wireshark - - 11/9/2022 1:51:51 PM desktop.ini - 174 Bytes - 9/29/2017 6:44:24 AM Program Files (x86) - - 11/9/2022 1:50:16 PM Adobe - - 3/5/2018 4:55:03 AM AutoIt3 - - 3/5/2018 4:54:29 AM Common Files - - 3/22/2022 8:57:21 AM Google - - 3/5/2018 6:11:56 AM Internet Explorer - - 9/29/2017 7:41:24 AM Java - - 3/5/2018 8:17:57 AM Microsoft - - 4/28/2022 10:32:59 AM Microsoft Analysis Services - - 3/22/2022 9:03:58 AM Microsoft Office - - 3/22/2022 9:03:52 AM Microsoft OneDrive - - 7/17/2018 5:54:37 AM Microsoft Visual Studio 8 - - 3/22/2022 9:04:12 AM Microsoft.NET - - 3/22/2022 9:05:42 AM MSBuild - - 10/7/2022 11:04:41 AM Reference Assemblies - - 10/7/2022 11:04:41 AM Windows Defender - - 9/29/2017 7:41:05 AM Windows Mail - - 3/5/2018 1:36:04 AM Windows Media Player - - 9/29/2017 7:41:29 AM Windows Multimedia Platform - - 9/29/2017 6:46:37 AM windows nt - - 9/29/2017 6:46:33 AM Windows Photo Viewer - - 9/29/2017 7:41:05 AM Windows Portable Devices - - 9/29/2017 6:46:37 AM Windows Sidebar - - 9/29/2017 6:46:33 AM WindowsPowerShell - - 9/29/2017 6:46:33 AM desktop.ini - 174 Bytes - 9/29/2017 6:44:24 AM ProgramData - - 11/12/2020 11:21:09 AM Adobe - - 9/13/2022 7:58:50 AM Application Data - - 3/5/2018 1:41:23 AM Comms - - 7/10/2015 4:04:22 AM Desktop - - 3/5/2018 1:41:23 AM Documents - - 3/5/2018 1:41:23 AM Microsoft - - 3/22/2022 9:42:12 AM Microsoft Help - - 3/22/2022 9:11:03 AM Microsoft OneDrive - - 3/5/2018 1:45:39 AM Oracle - - 3/5/2018 8:19:03 AM Package Cache - - 3/10/2023 6:46:55 AM regid.1991-06.com.microsoft - - 1/29/2019 7:51:30 AM SoftwareDistribution - - 9/29/2017 6:46:33 AM Start Menu - - 3/5/2018 1:41:23 AM Templates - - 3/5/2018 1:41:23 AM USOPrivate - - 11/21/2022 1:53:53 PM USOShared - - 3/5/2018 1:44:47 AM WindowsHolographicDevices - - 9/29/2017 7:42:49 AM ntuser.pol - 4.5 KB - 11/12/2020 11:21:09 AM Recovery - - 3/5/2018 1:41:23 AM System Volume Information - - 7/1/2018 11:01:41 PM tempdir - - 1/29/2019 7:06:26 AM Users - - 7/17/2023 10:20:29 PM All Users - - 9/29/2017 7:15:26 AM Default - - 3/5/2018 1:41:23 AM Default User - - 9/29/2017 7:15:26 AM HAPUBWS - - 11/9/2022 2:02:29 PM JfeTUJm - - 7/17/2023 10:20:29 PM Public - - 3/5/2018 1:36:04 AM desktop.ini - 174 Bytes - 9/29/2017 6:44:24 AM Windows - - 11/9/2022 1:55:18 PM 1.exe - 17.50 KB - 7/17/2023 10:19:07 PM bootmgr - 386.0 KB - 7/10/2015 4:00:31 AM BOOTNXT - 1 Bytes - 7/10/2015 4:00:31 AM bootTel.dat - 72 Bytes - 7/16/2018 2:09:55 AM pagefile.sys - 704.0 MB - 7/18/2023 6:15:44 AM swapfile.sys - 256.0 MB - 7/18/2023 6:15:44 AMZ:\ 1.exe - 17.50 KB - 7/18/2023 5:16:06 AM 1689657366698$MAPFAILURE - 0 Bytes - 7/17/2023 10:18:35 PM 1689657366698$OK - 0 Bytes - 7/17/2023 10:18:55 PM network_original.pcapng - 522.27 KB - 7/17/2023 10:20:26 PMC:\Users All Users - - 9/29/2017 7:15:26 AM Default - - 3/5/2018 1:41:23 AM Default User - - 9/29/2017 7:15:26 AM HAPUBWS - - 11/9/2022 2:02:29 PM .mitmproxy - - 11/9/2022 2:02:29 PM mitmproxy-ca-cert.cer - 1.14 KB - 11/9/2022 2:02:29 PM mitmproxy-ca-cert.p12 - 1.1 KB - 11/9/2022 2:02:29 PM mitmproxy-ca-cert.pem - 1.14 KB - 11/9/2022 2:02:29 PM mitmproxy-ca.p12 - 2.35 KB - 11/9/2022 2:02:29 PM mitmproxy-ca.pem - 2.78 KB - 11/9/2022 2:02:29 PM mitmproxy-dhparam.pem - 770 Bytes - 11/9/2022 2:02:29 PM 3D Objects - - 3/6/2018 12:59:14 AM desktop.ini - 298 Bytes - 3/6/2018 12:59:14 AM AppData - - 3/5/2018 1:38:48 AM Local - - 12/1/2022 1:39:42 PM Adobe - - 12/28/2018 8:44:24 PM Application Data - - 3/5/2018 1:38:36 AM Comms - - 3/5/2018 1:44:06 AM ConnectedDevicesPlatform - - 3/5/2018 1:44:02 AM DBG - - 3/5/2018 10:39:42 AM ElevatedDiagnostics - - 4/28/2022 10:29:21 AM Google - - 3/5/2018 5:38:03 AM History - - 3/5/2018 1:38:36 AM Microsoft - - 4/28/2022 10:33:35 AM Microsoft Help - - 3/5/2018 10:18:19 AM MicrosoftEdge - - 3/5/2018 1:44:15 AM Mozilla - - 3/5/2018 10:36:43 AM Package Cache - - 11/9/2022 1:54:44 PM Packages - - 11/12/2020 11:22:20 AM PeerDistRepub - - 3/7/2018 2:49:06 PM pip - - 12/1/2022 1:39:42 PM Programs - - 11/9/2022 1:54:44 PM Publishers - - 3/5/2018 8:21:15 AM Temp - - 7/17/2023 10:18:55 PM Temporary Internet Files - - 3/5/2018 1:38:36 AM TileDataLayer - - 3/5/2018 1:44:05 AM VirtualStore - - 3/5/2018 8:21:08 AM IconCache.db - 130.80 KB - 3/10/2023 6:53:56 AM LocalLow - - 3/5/2018 10:38:00 AM Adobe - - 3/5/2018 10:38:00 AM Microsoft - - 3/5/2018 5:00:14 AM Mozilla - - 1/29/2019 4:08:04 PM Sun - - 3/5/2018 8:18:13 AM Roaming - - 3/6/2018 1:54:47 AM Adobe - - 3/5/2018 10:38:00 AM Macromedia - - 3/5/2018 5:00:04 AM Microsoft - - 11/9/2022 1:55:18 PM Mozilla - - 3/5/2018 10:36:36 AM Sun - - 3/5/2018 4:55:36 AM Wireshark - - 3/6/2018 1:55:02 AM Application Data - - 3/5/2018 1:38:36 AM Contacts - - 3/6/2018 12:59:14 AM desktop.ini - 412 Bytes - 3/6/2018 12:59:14 AM Cookies - - 3/5/2018 1:38:36 AM Desktop - - 3/10/2023 6:53:14 AM desktop.ini - 282 Bytes - 3/6/2018 12:59:14 AM Documents - - 3/10/2023 6:50:36 AM My Music - - 3/5/2018 1:38:36 AM My Pictures - - 3/5/2018 1:38:36 AM My Videos - - 3/5/2018 1:38:36 AM OneNote Notebooks - - 3/10/2023 6:50:48 AM My Notebook - - 3/5/2018 10:33:57 AM OneNote 2010 Guide - - 3/10/2023 6:50:47 AM Unfiled Notes.one - 3.92 KB - 3/10/2023 6:51:11 AM Outlook Files - - 3/5/2018 10:34:35 AM Outlook.pst - 265.0 KB - 3/5/2018 10:34:35 AM Database1.accdb - 340.0 KB - 3/5/2018 10:31:42 AM desktop.ini - 402 Bytes - 3/6/2018 12:59:15 AM Downloads - - 3/10/2023 6:47:04 AM desktop.ini - 282 Bytes - 3/6/2018 12:59:14 AM MicrosoftEdgeSetup (1).exe - 1.74 MB - 4/28/2022 10:32:08 AM MicrosoftEdgeSetup.exe.xlzor0p.partial - 719.63 KB - 3/22/2022 9:40:47 AM npp.8.4.7.portable.x64.zip - 5.31 MB - 12/1/2022 1:46:22 PM Favorites - - 3/6/2018 12:59:14 AM Links - - 3/6/2018 12:59:14 AM desktop.ini - 80 Bytes - 3/6/2018 12:59:14 AM Bing.url - 208 Bytes - 11/8/2021 7:45:17 AM desktop.ini - 402 Bytes - 3/6/2018 12:59:14 AM Links - - 7/17/2018 5:54:37 AM desktop.ini - 504 Bytes - 3/6/2018 12:59:15 AM Desktop.lnk - 500 Bytes - 3/6/2018 12:59:15 AM Downloads.lnk - 945 Bytes - 3/6/2018 12:59:15 AM Local Settings - - 3/5/2018 1:38:36 AM MicrosoftEdgeBackups - - 3/5/2018 1:44:20 AM backups - - 4/28/2022 10:28:37 AM MicrosoftEdgeBackup20220428 - - 4/28/2022 10:28:37 AM Music - - 3/6/2018 12:59:14 AM desktop.ini - 504 Bytes - 3/6/2018 12:59:14 AM My Documents - - 3/5/2018 1:38:36 AM NetHood - - 3/5/2018 1:38:36 AM OneDrive - - 7/17/2018 5:54:37 AM desktop.ini - 98 Bytes - 7/17/2018 5:54:37 AM Pictures - - 3/6/2018 12:59:14 AM Camera Roll - - 3/5/2018 8:21:31 AM desktop.ini - 190 Bytes - 3/5/2018 8:21:31 AM Saved Pictures - - 3/5/2018 8:21:31 AM desktop.ini - 190 Bytes - 3/5/2018 8:21:31 AM desktop.ini - 504 Bytes - 3/6/2018 12:59:14 AM PrintHood - - 3/5/2018 1:38:36 AM Recent - - 3/5/2018 1:38:36 AM Saved Games - - 3/6/2018 12:59:15 AM desktop.ini - 282 Bytes - 3/6/2018 12:59:15 AM Searches - - 3/10/2023 6:51:04 AM desktop.ini - 524 Bytes - 3/6/2018 12:59:14 AM Everywhere.search-ms - 248 Bytes - 3/5/2018 8:21:08 AM Indexed Locations.search-ms - 248 Bytes - 3/5/2018 8:21:08 AM Microsoft OneNote.searchconnector-ms - 1.36 KB - 3/10/2023 6:51:04 AM winrt--{S-1-5-21-735145574-3570218355-1207367261-1001}-.searchconnector-ms - 855 Bytes - 3/5/2018 8:22:17 AM SendTo - - 3/5/2018 1:38:36 AM Start Menu - - 3/5/2018 1:38:36 AM Templates - - 3/5/2018 1:38:36 AM Videos - - 3/6/2018 12:59:14 AM desktop.ini - 504 Bytes - 3/6/2018 12:59:14 AM NTUSER.DAT - 3.25 MB - 3/10/2023 6:53:57 AM ntuser.dat.LOG1 - 0 Bytes - 3/5/2018 1:38:36 AM ntuser.dat.LOG2 - 144.0 KB - 3/5/2018 1:38:36 AM NTUSER.DAT{47a6a179-a514-11e7-a94e-ec0d9a05c860}.TxR.0.regtrans-ms - 1.0 MB - 7/1/2018 11:00:51 PM NTUSER.DAT{47a6a179-a514-11e7-a94e-ec0d9a05c860}.TxR.1.regtrans-ms - 1.0 MB - 7/1/2018 11:00:51 PM NTUSER.DAT{47a6a179-a514-11e7-a94e-ec0d9a05c860}.TxR.2.regtrans-ms - 1.0 MB - 7/1/2018 11:00:51 PM NTUSER.DAT{47a6a179-a514-11e7-a94e-ec0d9a05c860}.TxR.blf - 64.0 KB - 7/1/2018 11:00:51 PM NTUSER.DAT{47a6a17a-a514-11e7-a94e-ec0d9a05c860}.TM.blf - 64.0 KB - 3/5/2018 1:38:36 AM NTUSER.DAT{47a6a17a-a514-11e7-a94e-ec0d9a05c860}.TMContainer00000000000000000001.regtrans-ms - 512.0 KB - 3/5/2018 1:38:36 AM NTUSER.DAT{47a6a17a-a514-11e7-a94e-ec0d9a05c860}.TMContainer00000000000000000002.regtrans-ms - 512.0 KB - 3/5/2018 1:38:36 AM ntuser.ini - 20 Bytes - 3/5/2018 1:44:01 AM ntuser.pol - 0.98 KB - 11/12/2020 11:19:36 AM JfeTUJm - - 7/17/2023 10:20:29 PM .mitmproxy - - 11/9/2022 2:02:29 PM mitmproxy-ca-cert.cer - 1.14 KB - 11/9/2022 2:02:29 PM mitmproxy-ca-cert.p12 - 1.1 KB - 11/9/2022 2:02:29 PM mitmproxy-ca-cert.pem - 1.14 KB - 11/9/2022 2:02:29 PM mitmproxy-ca.p12 - 2.35 KB - 11/9/2022 2:02:29 PM mitmproxy-ca.pem - 2.78 KB - 11/9/2022 2:02:29 PM mitmproxy-dhparam.pem - 770 Bytes - 11/9/2022 2:02:29 PM 3D Objects - - 3/6/2018 12:59:14 AM desktop.ini - 298 Bytes - 3/6/2018 12:59:14 AM AppData - - 3/5/2018 1:38:48 AM Local - - 12/1/2022 1:39:42 PM Adobe - - 12/28/2018 8:44:24 PM Application Data - - 3/5/2018 1:38:36 AM Comms - - 3/5/2018 1:44:06 AM ConnectedDevicesPlatform - - 3/5/2018 1:44:02 AM DBG - - 3/5/2018 10:39:42 AM ElevatedDiagnostics - - 4/28/2022 10:29:21 AM Google - - 3/5/2018 5:38:03 AM History - - 3/5/2018 1:38:36 AM Microsoft - - 4/28/2022 10:33:35 AM Microsoft Help - - 3/5/2018 10:18:19 AM MicrosoftEdge - - 3/5/2018 1:44:15 AM Mozilla - - 3/5/2018 10:36:43 AM Package Cache - - 11/9/2022 1:54:44 PM Packages - - 11/12/2020 11:22:20 AM PeerDistRepub - - 3/7/2018 2:49:06 PM pip - - 12/1/2022 1:39:42 PM Programs - - 11/9/2022 1:54:44 PM Publishers - - 3/5/2018 8:21:15 AM Temp - - 7/17/2023 10:18:55 PM Temporary Internet Files - - 3/5/2018 1:38:36 AM TileDataLayer - - 3/5/2018 1:44:05 AM VirtualStore - - 3/5/2018 8:21:08 AM IconCache.db - 130.80 KB - 3/10/2023 6:53:56 AM LocalLow - - 3/5/2018 10:38:00 AM Adobe - - 3/5/2018 10:38:00 AM Microsoft - - 3/5/2018 5:00:14 AM Mozilla - - 1/29/2019 4:08:04 PM Sun - - 3/5/2018 8:18:13 AM Roaming - - 3/6/2018 1:54:47 AM Adobe - - 3/5/2018 10:38:00 AM Macromedia - - 3/5/2018 5:00:04 AM Microsoft - - 11/9/2022 1:55:18 PM Mozilla - - 3/5/2018 10:36:36 AM Sun - - 3/5/2018 4:55:36 AM Wireshark - - 3/6/2018 1:55:02 AM Application Data - - 3/5/2018 1:38:36 AM Contacts - - 3/6/2018 12:59:14 AM desktop.ini - 412 Bytes - 3/6/2018 12:59:14 AM Cookies - - 3/5/2018 1:38:36 AM Desktop - - 3/10/2023 6:53:14 AM desktop.ini - 282 Bytes - 3/6/2018 12:59:14 AM Documents - - 3/10/2023 6:50:36 AM My Music - - 3/5/2018 1:38:36 AM My Pictures - - 3/5/2018 1:38:36 AM My Videos - - 3/5/2018 1:38:36 AM OneNote Notebooks - - 3/10/2023 6:50:48 AM My Notebook - - 3/5/2018 10:33:57 AM" (Indicator: ".pst") in Source: lnbc0jefdb4.txt "Outlook.pst - 265.0 KB - 3/5/2018 10:34:35 AM" (Indicator: ".pst") in Source: lnbc0jefdb4.txt "??\C:\Users\JfeTUJm\Documents\Outlook Files\Outlook.pst" (Indicator: ".pst") in Source: 00000000-00007528.00000000.77233.54D40000.00000004.mdmp "Outlook.pst - 265.0 KB - 3/5/2018 10:34:35 AM" (Indicator: ".pst") in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "Outlook.pst" (Indicator: ".pst") in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "C:\Users\HAPUBWS\Documents\Outlook Files\Outlook.pst" (Indicator: ".pst") in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp "C:\Users\JfeTUJm\Documents\Outlook Files\Outlook.pst" (Indicator: ".pst") in Source: 00000000-00007528.00000000.77233.56D80000.00000004.mdmp31:T1760,"1.exe" loaded module "KERNEL32" at base 1bc80000 "1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 1a190000 "1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 1a190000 "1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 1a190000 "1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1af70000 "1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 1a190000 "1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 1a190000 "1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 1a190000 "1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 12e00000 "1.exe" loaded module "ADVAPI32.DLL" at base 1b0f0000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 12d50000 "1.exe" loaded module "SHLWAPI.DLL" at base 1ae40000 "1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 199a0000 "1.exe" loaded module "VERSION.DLL" at base 14b40000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base fa3e0000 "1.exe" loaded module "USER32.DLL" at base 1b760000 "1.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 1a190000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "1.exe" loaded module "NTDLL" at base 1d5e0000 "1.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 55010000 "1.exe" loaded module "PSAPI.DLL" at base 1ae30000 "1.exe" loaded module "KERNEL32.DLL" at base 1bc80000 "1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base f0ac0000 "1.exe" loaded module "RPCRT4.DLL" at base 1ba90000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "1.exe" loaded module "OLE32.DLL" at base 1afa0000 "1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 17f70000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "1.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 55010000 "1.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 1a190000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 12b40000 "1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base f9770000 "1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base fc070000 "1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base efa10000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "1.exe" loaded module "SHELL32.DLL" at base 1bf60000 "1.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 18d70000 "1.exe" loaded module "NTDLL.DLL" at base 1d5e0000 "1.exe" loaded module "SSPICLI.DLL" at base 19860000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "1.exe" loaded module "BCRYPT.DLL" at base 19430000 "1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base eef90000 "1.exe" loaded module "ADVAPI32" at base 1b0f0000 "1.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 1a520000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRCOMPRESSION.DLL" at base 13170000 "1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 127a0000 "1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base ee6e0000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "1.exe" loaded module "RASAPI32.DLL" at base e310000 "1.exe" loaded module "RASMAN.DLL" at base dd40000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "1.exe" loaded module "WS2_32.DLL" at base 1adc0000 "1.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 19160000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "1.exe" loaded module "WINHTTP.DLL" at base 137e0000 "1.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base fe3c0000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "1.exe" loaded module "IPHLPAPI.DLL" at base 18ef0000 "1.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 11940000 "1.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 123e0000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "1.exe" loaded module "SECUR32.DLL" at base 14920000 "1.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 18cb0000 "1.exe" loaded module "MSKEYPROTECT.DLL" at base cff0000 "1.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base db30000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "1.exe" loaded module "CRYPT32.DLL" at base 1a8e0000 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 12f8000032:T104d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007528-00000C24-14928080] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007528-00000C24-15037414] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007528-00000C24-15071105] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007528-00000C24-15112170] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007528-00000C24-15161025] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007528-00000C24-15180645] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007528-00000C24-15208714] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00007528-00000C24-15239691] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007528-00000C24-15255291] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00007528-00000C24-15263725] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00007528-00000C24-15273237] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007528-00000C24-15292137] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007528-00000C24-15506951] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007528-00000C24-15865864] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007528-00000C24-15883825] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll" [Source: 00000000-00007528-00000C24-15988903] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00007528-00000C24-17601780] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00007528-00000C24-17615225] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007528-00000C24-17651060] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00007528-00000C24-17679594] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00007528-00000C24-17707639] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00007528-00000C24-17739131] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00007528-00000C24-17848685] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00007528-00000C24-17989146] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00007528-00000C24-18157906]33:T62e,"1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\1.EXE"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")34:T9c3,"1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")35:T694,"1.exe" trying to access LNK file "C:\Users\%OSUSER%\Links\Desktop.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\Links\Downloads.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\.mitmproxy.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\.one.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\0kBbIG.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\1033.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\3N4fZbq.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\AdjacencyLetter.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\All Tasks.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\certifi.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\cNpP5hA8kVLj.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\Database1.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\DemoNotebook.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\Downloads.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\fuzzer.lnk" "1.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\fuzzer_winupdt.lnk"36:T8a0,"1.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "1.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "1.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "1.exe" trying to access non-existent file "C:\CRYPTSP.dll" "1.exe" trying to access non-existent file "C:\BCRYPT.DLL" "1.exe" trying to access non-existent file "C:\bcrypt.dll" "1.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "1.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "1.exe" trying to access non-existent file "C:\SSPICLI.DLL" "1.exe" trying to access non-existent file "C:\SspiCli.dll" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL"37:T711,"1.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "1.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "1.exe" trying to access non-existent file "C:\1.EXE.CONFIG" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "1.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1.EXE.LOG" "1.exe" trying to access non-existent file "C:\1.exe.config" "1.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\ALG" "1.exe" trying to access non-existent file "C:\1.INI" "1.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1.exe" trying to access non-existent file "C:\Program Files (x86)\AHNLAB" "1.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT" "1.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.IO.CB3B124C8#" "1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.IO.COMPRESSION.INI" "1.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.INI" "1.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SYSTEM.IO.CF61E09C5#" "1.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.INI"38:T2329,Pattern match: "https://tosals.ink/uEH5J.html" Heuristic match: "HTTP/1.1 200 OKDate: Tue, 18 Jul 2023 05:20:48 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/8.2.4CF-Cache-Status: DYNAMICReport-To: {endpoints:[{url:https:\/\/a.nel.cloudflare.com" Pattern match: "tosals.ink/uEH5J.html" Pattern match: "Microsoft.NET/Framework64/v4.0.30319/" Heuristic match: "ystem.drawing.ni" Heuristic match: "ystem.Drawing.ni" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "Microsoft.NET" Heuristic match: "C:\Program Files (x86)\Microsoft.NET" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms" Pattern match: "https://search.yahoo.com?fr=crmas_sfp" Pattern match: "www.bing.com/favicon.ico{bing:baseURL}search?q={searchTerms}&{bing:cvid}{bing:msb}{google:assistedQueryStats}UTF-8{bing:baseURL}qbox?query={searchTerms}&language={language}&{bing:partner}{bing:cvid}{bing:msb}{bing:ig}{google:inputType}{google:cursorPositio" Pattern match: "duckduckgo.com/favicon.icohttps://duckduckgo.com/?q={searchTerms}UTF-8https://duckduckgo.com/ac/?q={searchTerms}&type=list\" Pattern match: "https://duckduckgo.com/chrome_newtab" Pattern match: "www.google.com/images/branding/product/ico/googleg_lodp.ico{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchboxStats}{google:searchFieldtrialParameter}{google:iOSSearchLanguage}{" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170Latest" Pattern match: "https://www.bing.com/search?q=vs+crt+redist&cvid=b24c929981144c99bf0711b78929e24e&aqs=edge..69i57j0.6642j0j1&pglt=43&FORM=ANSPA1&PC=U531https://www.bing.com/ck/a?!&&p=dda47b155ec1706bJmltdHM9MTY3ODQwNjQwMCZpZ3VpZD0xYmQzZjhjNS1lMTdlLTZkNzctMWUxYi1lYWE2ZTU3Z" Pattern match: "https://www.bing.com/ck/a?!&&p=dda47b155ec1706bJmltdHM9MTY3ODQwNjQwMCZpZ3VpZD0xYmQzZjhjNS1lMTdlLTZkNzctMWUxYi1lYWE2ZTU3ZTYzMzUmaW5zaWQ9NTE4Ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-eaa6e57e6335&psq=vs+crt+redist&u=a1aHR0cHM6Ly9sZWFybi5taWNyb3NvZnQuY29tL" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redistLatest" Pattern match: "https://learn.microsoft.com/" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://www.bing.com/0xD3DD54E0377111B56531C055EED96D48522DAF8A56349E5E4953C317C37023A6Fri" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://www.bing.com/0x87789F00664B5C43450BECB3992A69A049F47F96864DF7493CF2044156074F91Wed" Pattern match: "https://notepad-plus-plus.org/" Pattern match: "https://notepad-plus-plus.org/downloads/v8.4.7/https://notepad-plus-plus.org/0x8DAC19BEAB8D6BATue" Pattern match: "https://notepad-plus-plus.org/downloads/v8.4.7/https://notepad-plus-plus.org/0x8DAC19BE7EC3BEATue" Pattern match: "https://download.visualstudio.microsoft.com/download/pr/8b92f460-7e03-4c75-a139-e264a770758d/26C2C72FBA6438F5E29AF8EBC4826A1E424581B3C446F8C735361F1DB7BEFF72/VC_redist.x64.exe3" Pattern match: "https://aka.ms/vs/17/release/vc_redist.x64.exe" Pattern match: "https://download.visualstudio.microsoft.com/download/pr/b2519016-4a13-4120-936c-cae003d567c4/8AE59D82845159DB3A70763F5CB1571E45EBF6A1ADFECC47574BA17B019483A0/VC_redist.x86.exe3" Pattern match: "https://aka.ms/vs/17/release/vc_redist.x86.exe" Pattern match: "https://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/6700583d-857f-4b14-8d22-4aeb6dfe418f?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20221201%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20221201" Pattern match: "https://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.zip" Pattern match: "objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20221201%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20221201T214615Z" Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7z" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170" Pattern match: "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist" Pattern match: "https://www.bing.com/search?q=vs+crt+redist&cvid=b24c929981144c99bf0711b78929e24e&aqs=edge..69i57j0.6642j0j1&pglt=43&FORM=ANSPA1&PC=U531" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77al" Heuristic match: "ntrust.net" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$WjI" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerTruLisPCA_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "nt.net" Pattern match: "www.microsoft.com/pki/certs/Mi" Pattern match: "http://microsoft.co"39:T63a2,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp") Found URL "https://tosals.ink/ueh5j.htmlplease" - Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp") Found URL "https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://search.yahoo.com?fr=crmas_sfpbingbing.comhttps://www.bing.com/favicon.ico" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://duckduckgo.com/ac/?q=" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://duckduckgo.com/chrome_newtabgooglegoogle.comhttps://www.google.com/images/branding/product/ico/googleg_lodp.ico" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170latest" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://www.bing.com/search?q=vs+crt+redist&cvid=b24c929981144c99bf0711b78929e24e&aqs=edge..69i57j0.6642j0j1&pglt=43&form=anspa1&pc=u531https://www.bing.com/ck/a?!&&p=dda47b155ec1706bjmltdhm9mty3odqwnjqwmczpz3vpzd0xymqzzjhjns1lmtdlltzknzctmwuxyi1lywe2ztu3ztyzmzumaw5zawq9nte4ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-eaa6e57e6335&psq=vs+crt+redist&u=a1ahr0chm6ly9szwfybi5tawnyb3nvznquy29tl2vulxvzl2nwcc93aw5kb3dzl2xhdgvzdc1zdxbwb3j0zwqtdmmtcmvkaxn0&ntb=1https://www.bing.com/ck/a?!&&p=dda47b155ec1706bjmltdhm9mty3odqwnjqwmczpz3vpzd0xymqzzjhjns1lmtdlltzknzctmwuxyi1lywe2ztu3ztyzmzumaw5zawq9nte4ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-eaa6e57e6335&psq=vs+crt+redist&u=a1ahr0chm6ly9szwfybi5tawnyb3nvznquy29tl2vulxvzl2nwcc93aw5kb3dzl2xhdgvzdc1zdxbwb3j0zwqtdmmtcmvkaxn0&ntb=1https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redistlatest" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://learn.microsoft.com/https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://www.bing.com/" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://notepad-plus-plus.org/https://notepad-plus-plus.org/downloads/v8.4.7/https://notepad-plus-plus.org/" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/8b92f460-7e03-4c75-a139-e264a770758d/26c2c72fba6438f5e29af8ebc4826a1e424581b3c446f8c735361f1db7beff72/vc_redist.x64.exe3https://aka.ms/vs/17/release/vc_redist.x64.exehttps://download.visualstudio.microsoft.com/download/pr/b2519016-4a13-4120-936c-cae003d567c4/8ae59d82845159db3a70763f5cb1571e45ebf6a1adfecc47574ba17b019483a0/vc_redist.x86.exe3https://aka.ms/vs/17/release/vc_redist.x86.exehttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/6700583d-857f-4b14-8d22-4aeb6dfe418f?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=akiaiwnjyax4csveh53a%2f20221201%2fus-east-1%2fs3%2faws4_request&x-amz-date=20221201t214621z&x-amz-expires=300&x-amz-signature=4bb95cb33f03c7d505c846e44254dcf6d4d73b4233fa90b97fff0dfcaa40bd14&x-amz-signedheaders=host&actor_id=0&key_id=0&repo_id=33014811&response-content-disposition=attachment%3b%20filename%3dnpp.8.4.7.portable.x64.zip&response-content-type=application%2foctet-streamphttps://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.zipehttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=akiaiwnjyax4csveh53a%2f20221201%2fus-east-1%2fs3%2faws4_request&x-amz-date=20221201t214615z&x-amz-expires=300&x-amz-signature=06388d75539e7861c543abf9d9aedd7f97e584804f84e88ac89a2da0528f3408&x-amz-signedheaders=host&actor_id=0&key_id=0&repo_id=33014811&response-content-disposition=attachment%3b%20filename%3dnpp.8.4.7.portable.x64.7z&response-content-type=application%2foctet-streamn_https://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zmindexsegments_url_idsegmentscreate" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redisthttps://www.bing.com/ck/a?!&&p=dda47b155ec1706bjmltdhm9mty3odqwnjqwmczpz3vpzd0xymqzzjhjns1lmtdlltzknzctmwuxyi1lywe2ztu3ztyzmzumaw5zawq9nte4ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-eaa6e57e6335&psq=vs+crt+redist&u=a1ahr0chm6ly9szwfybi5tawnyb3nvznquy29tl2vulxvzl2nwcc93aw5kb3dzl2xhdgvzdc1zdxbwb3j0zwqtdmmtcmvkaxn0&ntb=1https://www.bing.com/search?q=vs+crt+redist&cvid=b24c929981144c99bf0711b78929e24e&aqs=edge..69i57j0.6642j0j1&pglt=43&form=anspa1&pc=u531c\users\jfetujm\appdata\local\microsoft\edge\user" - Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;0@eoodhoo+>%y0'goodigicert" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=0koo" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://repository.swisssign.com/0" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0$(c\a6\4[=p(loo@mkoo" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/awww.pca_8l$0ht$8ld$@ll$hhrosoftl$0ht$8ld$@ll$hhft" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://cicro0croop06-2(//www.microsoft.com/pki/certs/miceraya'4iy()>@6tl$0ht$8ld$@ll$hhn1+0)e" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://microsoft.co='g@(;jkk\" - Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found URL "https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://search.yahoo.com?fr=crmas_sfpbingbing.comhttps://www.bing.com/favicon.ico" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://duckduckgo.com/ac/?q=" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://duckduckgo.com/chrome_newtabgooglegoogle.comhttps://www.google.com/images/branding/product/ico/googleg_lodp.ico" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170latest" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://www.bing.com/search?q=vs+crt+redist&cvid=b24c929981144c99bf0711b78929e24e&aqs=edge..69i57j0.6642j0j1&pglt=43&form=anspa1&pc=u531https://www.bing.com/ck/a?!&&p=dda47b155ec1706bjmltdhm9mty3odqwnjqwmczpz3vpzd0xymqzzjhjns1lmtdlltzknzctmwuxyi1lywe2ztu3ztyzmzumaw5zawq9nte4ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-eaa6e57e6335&psq=vs+crt+redist&u=a1ahr0chm6ly9szwfybi5tawnyb3nvznquy29tl2vulxvzl2nwcc93aw5kb3dzl2xhdgvzdc1zdxbwb3j0zwqtdmmtcmvkaxn0&ntb=1https://www.bing.com/ck/a?!&&p=dda47b155ec1706bjmltdhm9mty3odqwnjqwmczpz3vpzd0xymqzzjhjns1lmtdlltzknzctmwuxyi1lywe2ztu3ztyzmzumaw5zawq9nte4ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-eaa6e57e6335&psq=vs+crt+redist&u=a1ahr0chm6ly9szwfybi5tawnyb3nvznquy29tl2vulxvzl2nwcc93aw5kb3dzl2xhdgvzdc1zdxbwb3j0zwqtdmmtcmvkaxn0&ntb=1https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redistlatest" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://learn.microsoft.com/https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://www.bing.com/" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://notepad-plus-plus.org/https://notepad-plus-plus.org/downloads/v8.4.7/https://notepad-plus-plus.org/" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/8b92f460-7e03-4c75-a139-e264a770758d/26c2c72fba6438f5e29af8ebc4826a1e424581b3c446f8c735361f1db7beff72/vc_redist.x64.exe3https://aka.ms/vs/17/release/vc_redist.x64.exehttps://download.visualstudio.microsoft.com/download/pr/b2519016-4a13-4120-936c-cae003d567c4/8ae59d82845159db3a70763f5cb1571e45ebf6a1adfecc47574ba17b019483a0/vc_redist.x86.exe3https://aka.ms/vs/17/release/vc_redist.x86.exehttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/6700583d-857f-4b14-8d22-4aeb6dfe418f?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=akiaiwnjyax4csveh53a%2f20221201%2fus-east-1%2fs3%2faws4_request&x-amz-date=20221201t214621z&x-amz-expires=300&x-amz-signature=4bb95cb33f03c7d505c846e44254dcf6d4d73b4233fa90b97fff0dfcaa40bd14&x-amz-signedheaders=host&actor_id=0&key_id=0&repo_id=33014811&response-content-disposition=attachment%3b%20filename%3dnpp.8.4.7.portable.x64.zip&response-content-type=application%2foctet-streamphttps://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.zipehttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=akiaiwnjyax4csveh53a%2f20221201%2fus-east-1%2fs3%2faws4_request&x-amz-date=20221201t214615z&x-amz-expires=300&x-amz-signature=06388d75539e7861c543abf9d9aedd7f97e584804f84e88ac89a2da0528f3408&x-amz-signedheaders=host&actor_id=0&key_id=0&repo_id=33014811&response-content-disposition=attachment%3b%20filename%3dnpp.8.4.7.portable.x64.7z&response-content-type=application%2foctet-streamn_https://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zmindexsegments_url_idsegmentscreate" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redisthttps://www.bing.com/ck/a?!&&p=dda47b155ec1706bjmltdhm9mty3odqwnjqwmczpz3vpzd0xymqzzjhjns1lmtdlltzknzctmwuxyi1lywe2ztu3ztyzmzumaw5zawq9nte4ng&ptn=3&hsh=3&fclid=1bd3f8c5-e17e-6d77-1e1b-eaa6e57e6335&psq=vs+crt+redist&u=a1ahr0chm6ly9szwfybi5tawnyb3nvznquy29tl2vulxvzl2nwcc93aw5kb3dzl2xhdgvzdc1zdxbwb3j0zwqtdmmtcmvkaxn0&ntb=1https://www.bing.com/search?q=vs+crt+redist&cvid=b24c929981144c99bf0711b78929e24e&aqs=edge..69i57j0.6642j0j1&pglt=43&form=anspa1&pc=u531c\users\jfetujm\appdata\local\microsoft\edge\user" - Source: "00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;0@eoodhoo+>%y0'goodigicert" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://repository.swisssign.com/0" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0$(c\a6\4[=p(loo@mkoo" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://crl.microsoft.com/awww.pca_8l$0ht$8ld$@ll$hhrosoftl$0ht$8ld$@ll$hhft" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://cicro0croop06-2(//www.microsoft.com/pki/certs/miceraya'4iy()>@6twooo" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found URL "http://microsoft.co='g@(;jkk\" - Source: "00000000-00007528.00000002.81073.6F440000.00000004.mdmp")3a:T794,"1.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007528) "1.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\alg\* (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter b138f79dea860272ebe6694d9b73f656 (UID: 00000000-00007528) "1.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007528) "1.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00007528) "1.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter 1.exe (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter bootmgr (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter BOOTNXT (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00007528) "1.exe" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00007528)3b:Tf00,Found string "ZipFile" (Indicator: "zipfile"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found string "FromBase64String" (Indicator: "base64"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin") Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp, 00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found string "NTFSEnhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp, 00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp, 00000000-00007528.00000000.77233.56D80000.00000004.mdmp, 00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000001.79156.6F440000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.6F440000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007528.00000001.79156.6F440000.00000004.mdmp, 00000000-00007528.00000002.81073.6F440000.00000004.mdmp")3c:T94f,Found reference to API "10217080,7612,3024,,RtlGetVersion,NTDLL.dll,"00:20:03.046",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp, 00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "36024464197,7612,3025,,RtlGetNtProductType,NTDLL.dll,"00:20:16.968",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "38719929941,7612,3024,,RtlGetVersion,NTDLL.dll,"00:20:18.093",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "38717710713,7612,3025,,RtlGetNtProductType,NTDLL.dll,"00:20:18.078",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "36186205974,7612,3025,,RtlGetNtProductType,NTDLL.dll,"00:20:17.031",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "37422436086,7612,3024,,RtlGetVersion,NTDLL.dll,"00:20:17.546",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "37421873227,7612,3025,,RtlGetNtProductType,NTDLL.dll,"00:20:17.546",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "35040538188,7612,3025,,RtlGetNtProductType,NTDLL.dll,"00:20:16.546",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp") Found reference to API "36201545046,7612,3025,,RtlGetNtProductType,NTDLL.dll,"00:20:17.031",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp")3d:T5f5,Found string "??\C:\Users\JfeTUJm\Documents\Outlook Files" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp") Found string "??\C:\Users\JfeTUJm\Documents\Outlook Files\*" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp") Found string "??\C:\Users\JfeTUJm\Documents\Outlook Files\Outlook.pst" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.54D40000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Documents\Outlook Files" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Documents\Outlook Files\*" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") Found string "C:\Users\HAPUBWS\Documents\Outlook Files\Outlook.pst" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") Found string "C:\Users\JfeTUJm\Documents\Outlook Files" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") Found string "C:\Users\JfeTUJm\Documents\Outlook Files\*" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp") Found string "C:\Users\JfeTUJm\Documents\Outlook Files\Outlook.pst" (Indicator: "\documents\outlook files"; Source: "00000000-00007528.00000000.77233.56D80000.00000004.mdmp")3e:T96c,"1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3f:T45a,"1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-14766124 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-14766438 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-15311115 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-15311348 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-15438404 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-15438719 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-17754308 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-17754543 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-17855076 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-17855331 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-18164659 [PID: 7528] "1.exe" queried SystemProcessInformation at 00000000-00007528-00000C13-18164909 [PID: 7528]40:Ta80,"1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")41:T79b,"1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "1.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\1_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "1.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F0\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")42:Tc68,"1.exe" wrote bytes "3046ef1afc7f000040e9f21afc7f00005046ef1afc7f0000" to virtual address "0x1A103F10" (part of module "WINDOWS.STORAGE.DLL") "1.exe" wrote bytes "601f3419fc7f0000301e3419fc7f0000c01e3419fc7f0000" to virtual address "0x18D9D018" (part of module "RSAENH.DLL") "1.exe" wrote bytes "e08a441dfc7f00000088441dfc7f0000e088441dfc7f0000" to virtual address "0x0E3F9238" (part of module "RASAPI32.DLL") "1.exe" wrote bytes "433c66a24e720000" to virtual address "0xFABAFA70" (part of module "CLR.DLL") "1.exe" wrote bytes "654c8b1c25b0140000" to virtual address "0xFA3E2533" (part of module "CLR.DLL") "1.exe" wrote bytes "654c8b1c25b0140000" to virtual address "0xFA3E2570" (part of module "CLR.DLL") "1.exe" wrote bytes "b001531afc7f0000" to virtual address "0x1BBA71A8" (part of module "RPCRT4.DLL") "1.exe" wrote bytes "654c8b1c25b0140000" to virtual address "0xFA3E26ED" (part of module "CLR.DLL") "1.exe" wrote bytes "654c8b1c25b0140000" to virtual address "0xFA3E25EB" (part of module "CLR.DLL") "1.exe" wrote bytes "507c451dfc7f0000207f441dfc7f0000807e451dfc7f0000b0b8461dfc7f0000b087441dfc7f0000" to virtual address "0x0DD6F100" (part of module "RASMAN.DLL") "1.exe" wrote bytes "f0c5ae1bfc7f0000a07ea91bfc7f000070e5ae1bfc7f00002073aa1bfc7f0000d0abac1bfc7f000020c8ae1bfc7f000050d9a91bfc7f00004055b61bfc7f0000" to virtual address "0x0DD6F040" (part of module "RASMAN.DLL") "1.exe" wrote bytes "202e9a19fc7f0000302e9a19fc7f0000" to virtual address "0x552F8378" (part of module "COMBASE.DLL") "1.exe" wrote bytes "a09d5d1afc7f0000608e5d1afc7f000090b75b1afc7f0000a0905d1afc7f0000508d5b1afc7f0000502e5b1afc7f000020c45d1afc7f000070bb5d1afc7f000080bc5d1afc7f000040785e1afc7f0000a0ba5d1afc7f000000885d1afc7f0000" to virtual address "0x1BA84030" (part of module "GDI32.DLL") "1.exe" wrote bytes "706c8619fc7f000070a08619fc7f0000a02c8619fc7f0000" to virtual address "0x1B18D180" (part of module "ADVAPI32.DLL") "1.exe" wrote bytes "654c8b1c25b0140000" to virtual address "0xFA3E26A3" (part of module "CLR.DLL") "1.exe" wrote bytes "65488b0425b0140000" to virtual address "0xFA3E2BA0" (part of module "CLR.DLL") "1.exe" wrote bytes "6093dc1afc7f00005037dd1afc7f00002022dc1afc7f0000" to virtual address "0x0DD6F088" (part of module "RASMAN.DLL") "1.exe" wrote bytes "5049e40ffc7f00001019e40ffc7f0000901ce40ffc7f0000d01ae40ffc7f0000" to virtual address "0x0E3F93A0" (part of module "RASAPI32.DLL") "1.exe" wrote bytes "65488b0425b8140000" to virtual address "0xFA3E2C1B" (part of module "CLR.DLL") "1.exe" wrote bytes "65488b0425b8140000" to virtual address "0xFA3E2C5B" (part of module "CLR.DLL") "1.exe" wrote bytes "1019e40ffc7f0000901ce40ffc7f0000d01ae40ffc7f0000" to virtual address "0x0DD6F130" (part of module "RASMAN.DLL") "1.exe" wrote bytes "e08a441dfc7f0000" to virtual address "0x0DD6F0F0" (part of module "RASMAN.DLL") "1.exe" wrote bytes "b087441dfc7f0000702b451dfc7f0000" to virtual address "0x0E3F9258" (part of module "RASAPI32.DLL") "1.exe" wrote bytes "654c8b1c25b0140000" to virtual address "0xFA3E264E" (part of module "CLR.DLL") "1.exe" wrote bytes "654c8b1c25b0140000" to virtual address "0xFA3E29CC" (part of module "CLR.DLL")43:Ta38,"1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOCK" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOCK" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000003.log" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOCK" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "1.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790515181856,"unified_at":"2026-09-27T13:19:41.856Z","metadata":{"hashes":{"sha256":"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240","sha1":"a6b272f822b6205526ba56eee936afae1e695b0e","md5":"150e53a8c852ac5f23f47aceef452542","sha512":"acf3b6877d695943208b049566e253cbd822f364e8e161b0f06963aad2d07d0cf9f7314801eebcfa021a11284b313a0ed2688bf03dc82ff0120fdb03bc11a3ba","ssdeep":"384:Kz+m1kuPZXHcaYbT1AnoKRiwWy8PG8Xj6r:KzrOeZXHYbxcPRixy8e8XjS","ssdeep_chunks":["384:Kz+m1ku","384:z+m1kuP","384:+m1kuPZ","384:m1kuPZX","384:1kuPZXH","384:kuPZXHc","384:uPZXHca","384:PZXHcaY","384:ZXHcaYb","384:XHcaYbT","384:HcaYbT1","384:caYbT1A","384:aYbT1An","384:YbT1Ano","384:bT1AnoK","384:T1AnoKR","384:1AnoKRi","384:AnoKRiw","384:noKRiwW","384:oKRiwWy","384:KRiwWy8","384:RiwWy8P","384:iwWy8PG","384:wWy8PG8","384:Wy8PG8X","384:y8PG8Xj","384:8PG8Xj6","384:PG8Xj6r","768:Kz+m1ku","768:z+m1kuP","768:+m1kuPZ","768:m1kuPZX","768:1kuPZXH","768:kuPZXHc","768:uPZXHca","768:PZXHcaY","768:ZXHcaYb","768:XHcaYbT","768:HcaYbT1","768:caYbT1A","768:aYbT1An","768:YbT1Ano","768:bT1AnoK","768:T1AnoKR","768:1AnoKRi","768:AnoKRiw","768:noKRiwW","768:oKRiwWy","768:KRiwWy8","768:RiwWy8P","768:iwWy8PG","768:wWy8PG8","768:Wy8PG8X","768:y8PG8Xj","768:8PG8Xj6","768:PG8Xj6r","384:KzrOeZX","384:zrOeZXH","384:rOeZXHY","384:OeZXHYb","384:eZXHYbx","384:ZXHYbxc","384:XHYbxcP","384:HYbxcPR","384:YbxcPRi","384:bxcPRix","384:xcPRixy","384:cPRixy8","384:PRixy8e","384:Rixy8e8","384:ixy8e8X","384:xy8e8Xj","384:y8e8XjS"]},"file_info":{"file_name":"1.exe","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":17920,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1689656037000,"last_seen":1689656037000,"last_multi_scan":1689656037000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":50},"sandbox_signatures":{"informative_count":109,"suspicious_count":17,"malicious_count":2,"total":128},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability execute applications in hidden mode (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Dotnet code contains ability to query registry"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve operating system version"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"},{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Attempts to read Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"informative","value":"Contains ability to upload data with network (Dotnet)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability execute applications in hidden mode (Dotnet)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":1,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.ZipFile\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed function \"System.IO.Compression.ZipArchive\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed function \"System.IO.Compression.ZipArchiveEntry\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; File: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007528-00000BC0-15172173\")\n Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"HMAC\"; Source: \"00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007528.00000001.79156.6F440000.00000004.mdmp, 00000000-00007528.00000002.81073.6F440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007528.00000000.77233.52CB0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007528.00000001.79156.52CB0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007528.00000002.81073.52CB0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007528.00000001.79156.6F440000.00000004.mdmp, 00000000-00007528.00000002.81073.6F440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007528)\n \"1.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00007528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"1.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000072006f000000000000000000000000006500000000006600000000000000010000006f0020000000360034002064d6546f01000000000000010000000100000039005c000000000000000000400000005c006d00501cd7546f01000000000000140000000a0000006600690000000000 (UID: 00000000-00007528)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_SystemDirectory\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed function \"get_UserName\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\")\n Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00007528.00000000.77233.54D40000.00000004.mdmp\n 00000000-00007528.00000001.79156.54D40000.00000004.mdmp\n 00000000-00007528.00000002.81073.54D40000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"10217080,7612,3024,,RtlGetVersion,NTDLL.dll,\"00:20:03.046\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00007528.00000000.77233.54D40000.00000004.mdmp, 00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")\n Found reference to API \"38719929941,7612,3024,,RtlGetVersion,NTDLL.dll,\"00:20:18.093\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")\n Found reference to API \"37422436086,7612,3024,,RtlGetVersion,NTDLL.dll,\"00:20:17.546\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"1.exe\" queries volume information of \"C:\\1.exe\" at 00000000-00007528-00000C15-15180421\n \"1.exe\" queries volume information of \"C:\\\" at 00000000-00007528-00000C15-15424556\n \"1.exe\" queries volume information of \"C:\\\" at 00000000-00007528-00000C15-15424618\n \"1.exe\" queries volume information of \"C:\\share\" at 00000000-00007528-00000C15-15426861\n \"1.exe\" queries volume information of \"C:\\share\" at 00000000-00007528-00000C15-15426939\n \"1.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Compression\\v4.0_4.0.0.0__b77a5c561934e089\\System.IO.Compression.dll\" at 00000000-00007528-00000C15-15922633\n \"1.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IO.Compression.FileSystem\\v4.0_4.0.0.0__b77a5c561934e089\\System.IO.Compression.FileSystem.dll\" at 00000000-00007528-00000C15-15933864","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"1.exe\" queries volume information of \"C:\\\" at 00000000-00007528-00000C15-15424556\n \"1.exe\" queries volume information of \"C:\\\" at 00000000-00007528-00000C15-15424618","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"1.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\"1.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \"1.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.41.108:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\MyProjects\\SelfTraining\\Csharp\\ReconApp-Final\\ReconApp\\obj\\x64\\Release\\alg.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed function \"Process.Start\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:7528:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7528:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7528:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile\"\n \"Local\\SM0:7528:304:WilStaging_02\"\n \"SM0:7528:120:WilError_01\"\n \"Global\\RasPbFile\"\n \"SM0:7528:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValueNames\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"$30","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.zip\" (Indicator: \"github.com\")\n \"_https://github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7z\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"1.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at F0AC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"1.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1A520000\n \"1.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 19430000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"1.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at FA3E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 1BA90000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7301afc7f0000@ntdll.dll\"\n \"220023000000000018c7301afc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" was detected as \".NET\" and name: \"Library\"\n \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"1.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" file has an entrypoint instructions - \"pop\tr10,nop\t,add\tbyte ptr [rbx], al,add\tbyte ptr [rax], al,add\tbyte ptr [rax + rax], al,add\tbyte ptr [rax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"tosals.ink\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"1.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"1.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"0orsjjttefn.zip\" has type \"Zip archive data at least v2.0 to extract\"- Location: [%PUBLIC%\\Pictures\\0orsjjttefn.zip]- [targetUID: 00000000-00007528]\n \"lnbc0jefdb4.txt\" has type \"ASCII text with CRLF LF line terminators\"- Location: [%PUBLIC%\\Pictures\\lnbc0jefdb4.txt]- [targetUID: 00000000-00007528]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"1.exe\" queries basic process information of the \"C:\\1.exe\" (UID: 7528)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"1.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007528)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"1.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"1.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"\n \"1.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\b138f79dea860272ebe6694d9b73f656\\system.windows.forms.ni.dll.aux\"\n \"1.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\"\n \"1.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\ece80f2e3752a779e894fd45d8f27e64\\system.drawing.ni.dll.aux\"\n \"1.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll.aux\"\n \"1.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\default\\local extension settings\\jdiccldimpdaibmpdkjnbmckianbfold\\000003.log\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"1.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"1.exe\" trying to touch file \"C:\\1.exe\"\n \"1.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"1.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"1.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"1.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"1.exe\" writes file \"c:\\users\\public\\pictures\\lnbc0jefdb4.txt\"\n \"1.exe\" writes file \"c:\\users\\public\\pictures\\0orsjjttefn.zip\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007528-00000C25-17717972\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007528-00000C25-17818664\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007528-00000C25-17818683\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007528-00000C25-26432638\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"set_Encoding\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Encoding\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload data with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"UploadData\" in \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\"","origin":"Static Parser","mitre_attack_id":"T1005","relevance":1,"id":"static-142","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--{0}\\r\\nContent-Disposition: form-data; name=\\\"file\\\"; filename=\\\"{1}\\\"\\r\\n\"; File: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\")\n Found string \"Content-Disposition: form-data; name=\"file\"; filename=\"{1}\"\"; Source: \"00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp\")\n Found string \"Content-Disposition: form-data; name=\"file\"; filename=\"0orsjjttefn.zip\"\"; Source: \"00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; Source: \"00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /uEH5J.html HTTP/1.1Host: tosals.ink\n Connection: Keep-Alive","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://tosals.ink\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://tosals.ink/uEH5J.html\n Found HTTPS GET request to https://tosals.ink/uEH5J.html","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.41.108\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE797E8C1D1F757D00914EC5953E50]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"1.exe\" called \"GetComputerNameW\" (UID: 00000000-00007528)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"1.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"1.exe\" called \"GetUserNameW\" (UID: 00000000-00007528)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"11535882489,7612,3111,,FindFirstFileW,kernel32.dll,\"00:20:06.765\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007528.00000000.77233.54D40000.00000004.mdmp\")\n Found reference to API \"21417004077,7612,3113,,FindNextFileW,kernel32.dll,\"00:20:10.875\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")\n Found reference to API \"34757406127,7612,3113,,FindNextFileW,kernel32.dll,\"00:20:16.437\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")\n Found reference to API \"21413039825,7612,3113,,FindNextFileW,kernel32.dll,\"00:20:10.875\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"41553358059,7612,3114,,CreateToolhelp32Snapshot,kernel32.dll,\"00:20:19.265\",RX=0,PX=0\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")\n Found reference to API \"39669201216,7612,3114,,CreateToolhelp32Snapshot,kernel32.dll,\"00:20:18.484\",RX=0,PX=0\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\")\n Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007528.00000000.77233.52CB2000.00000002.mdmp, 00000000-00007528.00000001.79156.52CB2000.00000002.mdmp, 00000000-00007528.00000002.81073.52CB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00007528.00000001.79156.66D80000.00000004.mdmp, 00000000-00007528.00000002.81073.66D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00007528-00000C27-12677168324\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00007528-00000C27-13066148563\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"1.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007528)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007528.00000000.77233.54D40000.00000004.mdmp, 00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007528.00000000.77233.54D40000.00000004.mdmp, 00000000-00007528.00000001.79156.54D40000.00000004.mdmp, 00000000-00007528.00000002.81073.54D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007528.00000001.79156.54D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007528-00000C25-26406891","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"1.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00007528.00000001.79156.6F440000.00000004.mdmp, 00000000-00007528.00000002.81073.6F440000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$3f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"SIGN.MEDIA=35B9B1E2 VBoxWindowsAdditions.exe\" (Indicator: \"vbox\") in Source: lnbc0jefdb4.txt\n \"SIGN.MEDIA=15AB4D5 VBoxWindowsAdditions.exe\" (Indicator: \"vbox\") in Source: lnbc0jefdb4.txt\n \"SIGN.MEDIA=6714115 VBoxWindowsAdditions.exe\" (Indicator: \"vbox\") in Source: lnbc0jefdb4.txt\n \"SIGN.MEDIA=1EE6B990 VBoxWindowsAdditions.exe\" (Indicator: \"vbox\") in Source: lnbc0jefdb4.txt","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"UsrClass.dat{d2747a46-2058-11e8-b41f-0800274b5076}.TxR.0.regtrans-ms - 1.0 MB - 7/1/2018 11:00:51 PM\" (Indicator: \"080027\")\n \"UsrClass.dat{d2747a46-2058-11e8-b41f-0800274b5076}.TxR.1.regtrans-ms - 1.0 MB - 7/1/2018 11:00:51 PM\" (Indicator: \"080027\")\n \"UsrClass.dat{d2747a46-2058-11e8-b41f-0800274b5076}.TxR.2.regtrans-ms - 1.0 MB - 7/1/2018 11:00:51 PM\" (Indicator: \"080027\")\n \"UsrClass.dat{d2747a46-2058-11e8-b41f-0800274b5076}.TxR.blf - 64.0 KB - 7/1/2018 11:00:51 PM\" (Indicator: \"080027\")\n \"UsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TM.blf - 64.0 KB - 3/5/2018 1:38:36 AM\" (Indicator: \"080027\")\n \"UsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TMContainer00000000000000000001.regtrans-ms - 512.0 KB - 3/5/2018 1:38:36 AM\" (Indicator: \"080027\")\n \"UsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TMContainer00000000000000000002.regtrans-ms - 512.0 KB - 3/5/2018 1:38:36 AM\" (Indicator: \"080027\")\n \"{21FAD015-256D-11EE-9C2A-080027D2D982}\" (Indicator: \"080027\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/71 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"General","name":"PE file with no import directory","description":"\"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240.bin\" has no \"IMAGE_DIRECTORY_ENTRY_IMPORT\"","origin":"Static Parser","relevance":5,"id":"static-90","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"1.exe\" writes archive file \"C:\\Users\\Public\\Pictures\\0orsjjttefn.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Windows.Forms,4.0.0.0,,b77a5c561934e089\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture\"\n \"192.168.243.50\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.19\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.41.108 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"1.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007528)\n \"1.exe\" called \"GetDriveTypeW\" (UID: 00000000-00007528)\n \"1.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007528)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"C:\\Users\\JfeTUJm\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extension Scripts\" (Indicator: \"microsoft\\edge\\user data\") in Source: lnbc0jefdb4.txt\n \"C:\\Users\\JfeTUJm\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Extension State\" (Indicator: \"microsoft\\edge\\user data\") in Source: lnbc0jefdb4.txt","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"1.exe\" marked \"C:\\Users\\Public\\Pictures\\lnbc0jefdb4.txt\" for deletion\n \"1.exe\" marked \"C:\\Users\\Public\\Pictures\\0orsjjttefn.zip\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$42","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$43","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":75,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64b61ae40b8d20b70704a473","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan","contacted_countries":["USA"],"submit_name":"1.exe","analysis_start_time":"2023-07-18T05:15:07+00:00","indicators_count":{"informative":109,"suspicious":38,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.41.108","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}],"dns_resolutions":[{"domain":"tosals.ink","address":"104.21.41.108","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}],"processes":[{"pid":7528,"ppid":0,"name":"1.exe","command_line":"","sha256":"012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240","normalized_path":"C:\\1.exe","uid":"00000000-00007528","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["version.dll","clr.dll","IPHLPAPI.DLL","rasadhlp.dll","oleaut32.dll","cfgmgr32.dll","powrprof.dll","diasymreader.dll","gpapi.dll","apphelp.dll","msvcrt.dll","psapi.dll","clrjit.dll","System.Windows.Forms.ni.dll","rtutils.dll","secur32.dll","schannel.dll","ole32.dll","uxtheme.dll","profapi.dll","dhcpcsvc6.dll","fltLib.dll","sechost.dll","rasapi32.dll","mswsock.dll","KernelBase.dll","ws2_32.dll","gdi32.dll","System.ni.dll","dhcpcsvc.dll","winnsi.dll","ntasn1.dll","kernel32.dll","VxSSL64.dll","ucrtbase.dll","combase.dll","imm32.dll","ucrtbase_clr0400.dll","mscorlib.ni.dll","cryptbase.dll","System.Configuration.ni.dll","gdi32full.dll","SHCore.dll","rsaenh.dll","System.Xml.ni.dll","FWPUCLNT.DLL","cryptsp.dll","winhttp.dll","crypt32.dll","msasn1.dll","mscoreei.dll","System.Drawing.ni.dll","bcrypt.dll","rasman.dll","mskeyprotect.dll","ncryptsslp.dll","ntdll.dll","advapi32.dll","bcryptprimitives.dll","shlwapi.dll","kernel.appcore.dll","shell32.dll","System.Core.ni.dll","nsi.dll","windows.storage.dll","sspicli.dll","dnsapi.dll","ncrypt.dll","mscoree.dll","msvcp_win.dll","vcruntime140_clr0400.dll","clrcompression.dll","rpcrt4.dll","user32.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"0orsjjttefn.zip","sha256":"f1bc7611c237bd7ad5d2c41c31ff6a0200a1e8391115d39f4d4bd160b810cdbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"lnbc0jefdb4.txt","sha256":"5c7e92a523534949dcc528569e47d24d6e7102aee45ab9c054b5c10c8eea5bc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7528:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"Local\\SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"SM0:7528:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]},{"name":"SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64b61ae40b8d20b70704a473"}]}]}},"report_ids":{"sandbox_job_ids":["64b61ae40b8d20b70704a473"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 012063e0b7b4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 012063e0b7b4…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 012063e0b7b4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 012063e0b7b4…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/012063e0b7b4f7f3ce50574797112f95492772a9b75fc3d0934a91cc60faa240"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 012063e0b7b4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 012063e0b7b4…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 1/27 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]