JA3 fingerprint: 3b5074b1b5 d032e5620f 69f9f700ff 0eĬontains functionality to download additional files from the internetĬode function: 14_2_00007 FFE98DBADD 0 recv,WSA GetLastErr or,įound strings which match to known social media urls
JA3 SSL client fingerprint seen in connection with other malware 9.Installe r.圆4.exeĬode function: 0_2_004028 68 FindFir stFileW,Ĭode function: 0_2_004067 2B FindFir stFileW,Fi ndClose,Ĭode function: 0_2_00405A FA CloseHa ndle,Delet eFileW,lst rcatW,lstr catW,lstrl enW,FindFi rstFileW,F indNextFil eW,FindClo se,Ĭode function: 12_2_00007 FF6D990A88 0 FindFirs tFileW,Fin dNextFileW ,FindNextF ileW,FindC lose,Ĭode function: 12_2_00007 FF6D98F3E1 0 FindFirs tFileW,Fin dNextFileW ,FindClose ,Ĭode function: 14_2_00007 FF6ABDAA9A 4 FindFirs tFileExA,Ĭode function: 14_2_00007 FFE98E0B08 4 FindFirs tFileExA, Source: C:\Program Files\Not epad++\upd ater\GUP.e xeĬode function: 14_2_00007 FFE98DE7F4 0 CryptAcq uireContex tA,CryptCr eateHash,C ryptHashDa ta,CryptGe tHashParam ,CryptDest royHash,Cr yptRelease Context,Ĭode function: 14_2_00007 FFE98DE807 0 CryptAcq uireContex tA,CryptIm portKey,Cr yptRelease Context,Cr yptEncrypt ,CryptDest royKey,Cry ptReleaseC ontext,Ĭode function: 14_2_00007 FFE98DF41C 0 CryptAcq uireContex tA,CryptGe nRandom,Cr yptRelease Context,Cr yptRelease Context,Ĭode function: 14_2_00007 FFE98DD87C 0 CryptHas hData,Ĭode function: 14_2_00007 FFE98DD87D 0 CryptGet HashParam, CryptGetHa shParam,Cr yptDestroy Hash,Crypt ReleaseCon text,Ĭode function: 14_2_00007 FFE98DD877 0 CryptAcq uireContex tA,CryptCr eateHash,Ĭontains functionality to enumerate / list files inside a directory Source: C:\Program Files\Not epad++\not epad++.exeĬode function: 12_2_00007 FF6D98E9E1 D OutputDe bugStringW ,GetLastEr ror,Output DebugStrin gW,WinVeri fyTrust,Wi nVerifyTru st,OutputD ebugString W,CryptQue ryObject,G etLastErro r,_CxxThro wException ,CryptMsgG etParam,Ge tLastError ,_CxxThrow Exception, LocalAlloc ,_CxxThrow Exception, CryptMsgGe tParam,Get LastError, _CxxThrowE xception,C ertFindCer tificateIn Store,GetL astError,_ CxxThrowEx ception,Ce rtNameToSt rW,_CxxThr owExceptio n,CertName ToStrW,_Cx xThrowExce ption,Cert GetCertifi cateContex tProperty, GetLastErr or,_CxxThr owExceptio n,CertGetC ertificate ContextPro perty,GetL astError,_ CxxThrowEx ception,Ou tputDebugS tringW,Cer tGetNameSt ringW,GetL astError,_ CxxThrowEx ception,Ce rtGetNameS tringW,Get LastError, _CxxThrowE xception,O utputDebug StringW,Ou tputDebugS tringW,Out putDebugSt ringW,Cert CloseStore ,CryptMsgC lose,Local Free,Ĭode function: 12_2_00007 FF6D98EAAE 1 CertClos eStore,Cry ptMsgClose ,LocalFree , Uses Microsoft's Enhanced Cryptographic Provider
0 kommentar(er)
