exeĬode function: 0_2_003265 6C _ehhan dler$?_Run askCollect W4_TaskCol lectionSta _Unrealize olog3,lstr lenW,Crypt QueryObjec t,CryptMsg GetParam,C ryptMsgGet Param,Loca lAlloc,Cry ptMsgGetPa ram,CertFi ndCertific ateInStore ,CertFreeC ertificate Context,Ce rtCloseSto re,CryptMs gClose,Loc alFree,Ĭode function: 0_2_003267 5D _ehhan APAXIABUno _prolog3,l strcmpA,Cr yptDecodeO bject,Loca lAlloc,Cry ptDecodeOb ject,Local Free,Ĭode function: 0_2_0031A9 F2 CryptAc quireConte xtW,CryptA cquireCont extW,Crypt AcquireCon textW,Cryp tAcquireCo ntextW,Get LastError, CryptCreat eHash,Crea teFileW,Cr yptRelease Context,Re adFile,Cry ptHashData ,ReadFile, CryptRelea seContext, CryptDestr oyHash,Clo seHandle,C ryptReleas eContext,C ryptDestro yHash,Clos eHandle,Cr yptGetHash Param,Cryp tDestroyHa sh,CryptRe leaseConte xt,CloseHa ndle,Crypt DestroyHas h,CryptRel easeContex t,CloseHan dle,Ĭode function: 2_2_003265 6C _ehhan dler$?_Run askCollect W4_TaskCol lectionSta _Unrealize olog3,lstr lenW,Crypt QueryObjec t,CryptMsg GetParam,C ryptMsgGet Param,Loca lAlloc,Cry ptMsgGetPa ram,CertFi ndCertific ateInStore ,CertFreeC ertificate Context,Ce rtCloseSto re,CryptMs gClose,Loc alFree,Ĭode function: 2_2_003267 5D _ehhan APAXIABUno _prolog3,l strcmpA,Cr yptDecodeO bject,Loca lAlloc,Cry ptDecodeOb ject,Local Free,Ĭode function: 2_2_0031A9 F2 CryptAc quireConte xtW,CryptA cquireCont extW,Crypt AcquireCon textW,Cryp tAcquireCo ntextW,Get LastError, CryptCreat eHash,Crea teFileW,Cr yptRelease Context,Re adFile,Cry ptHashData ,ReadFile, CryptRelea seContext, CryptDestr oyHash,Clo seHandle,C ryptReleas eContext,C ryptDestro yHash,Clos eHandle,Cr yptGetHash Param,Cryp tDestroyHa sh,CryptRe leaseConte xt,CloseHa ndle,Crypt DestroyHas h,CryptRel easeContex t,CloseHan dle,įile opened: C:\Users\u ser\AppDat a\Local\Te mpįile opened: C:\Users\u ser\AppDat a\Local\Te mp\apn_pip _localįile opened: C:\Users\u ser\AppDat a\Localįile opened: C:\Users\u ser\AppDat a\Local\Te mp\apn_pip _local\obj ectModel.j sĬontains functionality to enumerate / list files inside a directoryĬode function: 0_2_003235 51 _EH_pr olog3_GS,_ wcslen,_wc slen,FindF irstFileW, FindNextFi leW,_wcsi coll,_wcs icoll,_wcs len,GetLas tError,Fin dClose,Ĭode function: 2_2_003235 51 _EH_pr olog3_GS,_ wcslen,_wc slen,FindF irstFileW, FindNextFi leW,_wcsi coll,_wcs icoll,_wcs len,GetLas tError,Fin dClose,ĭomain name seen in connection with other malware Source: C:\Users\u ser\Deskto p\Offercas t2801_ARS_. Uses Microsoft's Enhanced Cryptographic Provider
0 kommentar(er)
