Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'UPEditorEdge

malicious

Threat Score: 100/100 AV Detection: Marked as clean #evasive

UPEditorEdge_1.exe

This report is generated from a file or URL submitted to this webservice on April 30th 2018 04:14:58 (UTC)
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by Falcon Sandbox v8.00 © Hybrid Analysis

Overview Sample unavailable Re-analyze Hash Seen Before Show Similar Samples Report False-Positive Request Report Deletion

Incident Response

Risk Assessment

Persistence: Modifies System Certificates Settings
Spawns a lot of processes
Writes data to a remote process
Writes to the hosts file
Fingerprint: Reads the active computer name
Reads the cryptographic machine GUID
Spreading: Opens the MountPointManager (often used to detect additional infection locations)
Network Behavior: Contacts 2 hosts. View all details

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 13
General
- The analysis extracted a file that was identified as malicious
  
  details
  
  1/76 Antivirus vendors marked dropped file "certutil.exe" as malicious (classified as "Trojan.Heur" with 1% detection rate)
  1/66 Antivirus vendors marked dropped file "killer.dll" as malicious (classified as "Unsafe" with 1% detection rate)
  
  source
  
  Binary File
  
  relevance
  
  10/10
- The analysis spawned a process that was identified as malicious
  
  details
  
  1/76 Antivirus vendors marked spawned process "certutil.exe" (PID: 2956) as malicious (classified as "Trojan.Heur" with 1% detection rate)
  
  source
  
  Monitored Target
  
  relevance
  
  10/10
Installation/Persistance
- Allocates virtual memory in a remote process
  
  details
  
  "<Input Sample>" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Classes\Folder"
  "<Input Sample>" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer"
  "UPSecurityInput.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide"
  
  source
  
  API Call
  
  relevance
  
  7/10
- Writes data to a remote process
  
  details
  
  "<Input Sample>" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPEditor.exe" (Handle: 480)
  "<Input Sample>" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPEditor.exe" (Handle: 480)
  "<Input Sample>" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPEditor.exe" (Handle: 480)
  "<Input Sample>" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPEditor.exe" (Handle: 480)
  "<Input Sample>" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPService.exe" (Handle: 28)
  "<Input Sample>" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPService.exe" (Handle: 28)
  "<Input Sample>" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPService.exe" (Handle: 28)
  "<Input Sample>" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPService.exe" (Handle: 28)
  "<Input Sample>" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPSecurityInput.exe" (Handle: 480)
  "<Input Sample>" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPSecurityInput.exe" (Handle: 480)
  "<Input Sample>" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPSecurityInput.exe" (Handle: 480)
  "<Input Sample>" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\UPSecurityInput.exe" (Handle: 480)
  "<Input Sample>" wrote 32 bytes to a remote process "%TEMP%\certmgr.exe" (Handle: 844)
  "<Input Sample>" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\certmgr.exe" (Handle: 844)
  "<Input Sample>" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\certmgr.exe" (Handle: 844)
  "<Input Sample>" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\certmgr.exe" (Handle: 844)
  "<Input Sample>" wrote 32 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\certmgr.exe" (Handle: 880)
  "<Input Sample>" wrote 52 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\certmgr.exe" (Handle: 880)
  "<Input Sample>" wrote 4 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\certmgr.exe" (Handle: 880)
  "<Input Sample>" wrote 8 bytes to a remote process "C:\Users\%USERNAME%\AppData\Local\Temp\certmgr.exe" (Handle: 880)
  "UPSecurityInput.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 244)
  "UPSecurityInput.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 244)
  "UPSecurityInput.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 244)
  "UPSecurityInput.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 244)
  "UPSecurityInput.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 256)
  "UPSecurityInput.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 256)
  "UPSecurityInput.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 256)
  "UPSecurityInput.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 256)
  "UPSecurityInput.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\certutil.exe" (Handle: 312)
  "UPSecurityInput.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\certutil.exe" (Handle: 312)
  "UPSecurityInput.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\certutil.exe" (Handle: 312)
  "UPSecurityInput.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\UPEditNew\certutil.exe" (Handle: 312)
  
  source
  
  API Call
  
  relevance
  
  6/10
Network Related
- Writes to the hosts file
  
  details
  
  "UPService.exe" wrote to file "%WINDIR%\System32\drivers\etc\hosts"
  
  source
  
  API Call
  
  relevance
  
  10/10
System Security
- Modifies System Certificates Settings
  
  details
  
  "certmgr.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "FF9CEB13C83F15B800E6EFF987B2C72E01B4B320")
  "certmgr.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\FF9CEB13C83F15B800E6EFF987B2C72E01B4B320"; Key: "BLOB")
  "certmgr.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "07E032E020B72C3F192F0628A2593A19A70F069E")
  "certmgr.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
Unusual Characteristics
- Contains native function calls
  
  details
  
  NtdllDefWindowProc_A@NTDLL.DLL from UPEditorEdge_1.exe (PID: 3372) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  5/10
- Spawns a lot of processes
  
  details
  
  Spawned process "<Input Sample>" (Show Process)
  Spawned process "UPEditor.exe" with commandline ""-s"" (Show Process)
  Spawned process "UPService.exe" with commandline ""-install"" (Show Process)
  Spawned process "UPSecurityInput.exe" with commandline "%WINDIR%\system32\UPEditNew\UPSecurityInput.exe" (Show Process)
  Spawned process "UPService.exe" with commandline ""-control" "UPSecurityInputService" "start"" (Show Process)
  Spawned process "UPService.exe" (Show Process)
  Spawned process "schtasks.exe" with commandline "%WINDIR%\system32\schtasks.exe /delete /tn "ÒøÁªÔÚÏß°²È«ÊäÈë³ÌÐò" /f" (Show Process)
  Spawned process "schtasks.exe" with commandline "%WINDIR%\system32\schtasks.exe /create /tn "ÒøÁªÔÚÏß°²È«ÊäÈë³ÌÐò" /tr "%WINDIR%\SysWOW64\UPEditNew\UPSecurityInput.exe" /sc onlogon" (Show Process)
  Spawned process "certutil.exe" with commandline "-A -d "%APPDATA%\Mozilla\Firefox\Profiles\fg6ygf16.default" -i .\root_bundle.crt -n "WoSign Class 1 DV Server CA G2" -t "C
  
  "" (Show Process)
  Spawned process "certmgr.exe" with commandline "-add "%TEMP%\wosign.cer" -c -s -r localMachine Root" (Show Process)
  Spawned process "certmgr.exe" with commandline "-add "%TEMP%\mysign.cer" -c -s -r localMachine CA" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  8/10
Hiding 5 Malicious Indicators
- All indicators are available only in the private webservice or standalone version

Suspicious Indicators 36
Anti-Detection/Stealthyness
- Queries kernel debugger information
  
  details
  
  "UPSecurityInput.exe" at 00016014-00002328-00000033-63403239
  "certmgr.exe" at 00018812-00003184-00000033-69113830
  "certmgr.exe" at 00019421-00002444-00000033-71379807
  
  source
  
  API Call
  
  relevance
  
  6/10
- Queries process information
  
  details
  
  "<Input Sample>" queried SystemProcessInformation at 00013355-00003372-00000033-53004572
  "<Input Sample>" queried SystemProcessInformation at 00013355-00003372-00000033-53017098
  "<Input Sample>" queried SystemProcessInformation at 00013355-00003372-00000033-53017296
  "<Input Sample>" queried SystemProcessInformation at 00013355-00003372-00000033-53035039
  "<Input Sample>" queried SystemProcessInformation at 00013355-00003372-00000033-53035180
  "<Input Sample>" queried SystemProcessInformation at 00013355-00003372-00000033-55229271
  "<Input Sample>" queried SystemProcessInformation at 00013355-00003372-00000033-55229456
  "UPSecurityInput.exe" queried SystemProcessInformation at 00016014-00002328-00000033-63410956
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-63086961
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-63087196
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-64718163
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-64718376
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-65604232
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-65604463
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-66579834
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-66580053
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-67532954
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-67533168
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-68445878
  "UPService.exe" queried SystemProcessInformation at 00017017-00001080-00000033-68446034
  
  source
  
  API Call
  
  relevance
  
  4/10
Anti-Reverse Engineering
- PE file has unusual entropy sections
  
  details
  
  .upx1 with unusual entropies 7.91133806504
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Cryptographic Related
- Found a cryptographic related string
  
  details
  
  "DES" (Indicator: "des"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "des" (Indicator: "des"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "blowfish" (Indicator: "blowfish"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "AES128" (Indicator: "aes128"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "aes128" (Indicator: "aes128"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "AES192" (Indicator: "aes192"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "aes192" (Indicator: "aes192"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "AES256" (Indicator: "aes256"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "aes256" (Indicator: "aes256"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "RC4" (Indicator: "rc4"; File: "00016014-00002328.00000001.18257.00161000.00000020.mdmp")
  "ecdsa" (Indicator: "ecdsa"; File: "00016014-00002328.00000001.18257.0025F000.00000002.mdmp")
  "rc4" (Indicator: "rc4"; File: "00016014-00002328.00000001.18257.0025F000.00000002.mdmp")
  "ECDSA" (Indicator: "ecdsa"; File: "00016014-00002328.00000001.18257.0025F000.00000002.mdmp")
  
  source
  
  File/Memory
  
  relevance
  
  10/10
Environment Awareness
- Contains ability to measure performance
  
  details
  
  rdtsc from UPService.exe (PID: 2584) (Show Stream)
  rdtsc from UPSecurityInput.exe (PID: 2328) (Show Stream)
  rdtsc from UPSecurityInput.exe (PID: 2328) (Show Stream)
  rdtsc from UPService.exe (PID: 2340) (Show Stream)
  rdtsc from UPService.exe (PID: 1080) (Show Stream)
  rdtsc (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Contains ability to query CPU information
  
  details
  
  cpuid from UPService.exe (PID: 2584) (Show Stream)
  cpuid from UPSecurityInput.exe (PID: 2328) (Show Stream)
  cpuid from UPSecurityInput.exe (PID: 2328) (Show Stream)
  cpuid from UPService.exe (PID: 2340) (Show Stream)
  cpuid from UPService.exe (PID: 1080) (Show Stream)
  cpuid (Show Stream)
  cpuid (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Found a reference to a WMI query string known to be used for VM detection
  
  details
  
  "Win32_BIOS" (Indicator: "win32_bios"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  "Win32_Processor" (Indicator: "win32_process"; File: "00016014-00002328.00000001.18257.00160000.00000002.mdmp")
  
  source
  
  File/Memory
  
  relevance
  
  10/10
- Reads the active computer name
  
  details
  
  "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "UPEditor.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "UPService.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "UPSecurityInput.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  "certutil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
  
  source
  
  Registry Access
  
  relevance
  
  5/10
- Reads the cryptographic machine GUID
  
  details
  
  "UPSecurityInput.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
External Systems
- Found an IP/URL artifact that was identified as malicious by at least one reputation engine
  
  details
  
  1/67 reputation engines marked "http://nsis.sf.net" as malicious (1% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
General
- Reads configuration files
  
  details
  
  "<Input Sample>" read file "%USERPROFILE%\Desktop\desktop.ini"
  "<Input Sample>" read file "%USERPROFILE%\Users\%OSUSER%\Searches\desktop.ini"
  "<Input Sample>" read file "%USERPROFILE%\Videos\desktop.ini"
  "<Input Sample>" read file "%USERPROFILE%\Pictures\desktop.ini"
  "<Input Sample>" read file "%USERPROFILE%\Contacts\desktop.ini"
  "<Input Sample>" read file "%USERPROFILE%\Favorites\desktop.ini"
  "<Input Sample>" read file "%USERPROFILE%\Music\desktop.ini"
  
  source
  
  API Call
  
  relevance
  
  4/10
Installation/Persistance
- Drops executable files
  
  details
  
  "certmgr.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
  "msvcr120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nspr4.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "smime3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "KillProcDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "plc4.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nssutil3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "UPService.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  "certutil.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
  "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"
  "plds4.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "killer.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "FindProcDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "UPSecurityInput.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  
  source
  
  Binary File
  
  relevance
  
  10/10
Network Related
- Found potential IP address in binary/memory
  
  details
  
  Heuristic match: "UnionPay Security Non plug 1.0.0.4 Setup"
  Heuristic match: "%USERPROFILE%\Desktop\UnionPay Security Non plug 1.0.0.3.lnk"
  Heuristic match: "all\UnionPay Security Non plug 1.0.0.3"
  Heuristic match: "Please wait while UnionPay Security Non plug 1.0.0.4 installation process is running."
  Heuristic match: "UnionPay Security Non plug 1.0.0.3.lnk"
  Heuristic match: "g 1.0.0.3"
  "1.0.1.1"
  "1.0.1.8"
  "1.0.0.4"
  Heuristic match: "Origin: http://192.168.8.72:8080"
  "1.0.1.3"
  Heuristic match: "Host: 192.168.8.72:8080"
  "127.0.0.1"
  Heuristic match: "%-20s - OID (example): 1.2.3.4"
  Heuristic match: "OID.2.5.29.32.0"
  "2.5.29.1"
  "2.5.29.35"
  "2.5.29.31"
  "2.5.29.14"
  "2.5.29.2"
  "2.5.29.7"
  "2.5.29.8"
  "2.5.29.17"
  "2.5.29.18"
  Heuristic match: "1.3.6.1.4.1.311.10.2"
  "2.5.29.4"
  "2.5.29.10"
  "2.5.29.15"
  "2.5.29.19"
  "2.5.29.32"
  Heuristic match: "1.3.6.1.4.1.311.2.1.10"
  Heuristic match: "1.3.6.1.4.1.311.2.1.27"
  Heuristic match: "1.3.6.1.4.1.311.2.1.26"
  "2.5.4.3"
  "2.5.29.37"
  "2.5.29.21"
  
  source
  
  File/Memory
  
  relevance
  
  3/10
- Reads the hosts file
  
  details
  
  "UPService.exe" read 824 bytes from file "%WINDIR%\System32\drivers\etc\hosts"
  "UPService.exe" read 863 bytes from file "%WINDIR%\System32\drivers\etc\hosts"
  
  source
  
  API Call
  
  relevance
  
  10/10
Remote Access Related
- Contains references to WMI/WMIC
  
  details
  
  "root\cimv2" (Indicator: "root\cimv2")
  
  source
  
  File/Memory
  
  relevance
  
  10/10
Spyware/Information Retrieval
- Contains ability to open the clipboard
  
  details
  
  OpenClipboard@USER32.DLL from UPEditorEdge_1.exe (PID: 3372) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
System Destruction
- Marks file for deletion
  
  details
  
  "C:\UPEditorEdge_1.exe" marked "%TEMP%\nsf5351.tmp" for deletion
  "C:\UPEditorEdge_1.exe" marked "%TEMP%\nsf543C.tmp" for deletion
  "C:\UPEditorEdge_1.exe" marked "%TEMP%\certmgr.exe" for deletion
  "C:\UPEditorEdge_1.exe" marked "%TEMP%\wosign.cer" for deletion
  "C:\UPEditorEdge_1.exe" marked "%TEMP%\mysign.cer" for deletion
  
  source
  
  API Call
  
  relevance
  
  10/10
- Opens file with deletion access rights
  
  details
  
  "<Input Sample>" opened "%TEMP%\nsf5351.tmp" with delete access
  "<Input Sample>" opened "%TEMP%\nsf543C.tmp" with delete access
  "<Input Sample>" opened "%TEMP%\certmgr.exe" with delete access
  "<Input Sample>" opened "%TEMP%\wosign.cer" with delete access
  "<Input Sample>" opened "%TEMP%\mysign.cer" with delete access
  
  source
  
  API Call
  
  relevance
  
  7/10
System Security
- Modifies proxy settings
  
  details
  
  "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "<Input Sample>" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
- Queries sensitive IE security settings
  
  details
  
  "<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
Unusual Characteristics
- CRC value set in PE header does not match actual value
  
  details
  
  "certmgr.exe" claimed CRC 125532 while the actual is CRC 6866587
  "msvcr120.dll" claimed CRC 1028896 while the actual is CRC 125532
  "UPService.exe" claimed CRC 411681 while the actual is CRC 831544
  "certutil.exe" claimed CRC 170725 while the actual is CRC 411681
  "uninst.exe" claimed CRC 6866587 while the actual is CRC 170725
  "UPEditor.exe" claimed CRC 610677 while the actual is CRC 37199
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Entrypoint in PE header is within an uncommon section
  
  details
  
  "UPService.exe" has an entrypoint in section ".upx1"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Imports suspicious APIs
  
  details
  
  RegDeleteKeyA
  RegCloseKey
  RegOpenKeyExA
  RegDeleteValueA
  RegCreateKeyExA
  RegEnumKeyA
  GetFileAttributesA
  CopyFileA
  GetModuleFileNameA
  LoadLibraryA
  LoadLibraryExA
  GetFileSize
  CreateDirectoryA
  DeleteFileA
  GetCommandLineA
  GetProcAddress
  GetTempPathA
  CreateThread
  GetModuleHandleA
  FindFirstFileA
  WriteFile
  GetTempFileNameA
  FindNextFileA
  CreateProcessA
  Sleep
  CreateFileA
  GetTickCount
  ShellExecuteA
  FindWindowExA
  CertDeleteCertificateFromStore
  UnhandledExceptionFilter
  MapViewOfFile
  CreateFileMappingA
  TerminateProcess
  CreateFileW
  GetDriveTypeW
  GetTempPathW
  OutputDebugStringW
  OutputDebugStringA
  GetModuleFileNameW
  LoadLibraryExW
  ExitThread
  GetModuleHandleExW
  LoadLibraryW
  GetVersionExW
  VirtualProtect
  GetStartupInfoW
  CreateDirectoryW
  DeleteFileW
  FindFirstFileExA
  FindNextFileW
  FindFirstFileExW
  IsDebuggerPresent
  GetCommandLineW
  GetModuleHandleW
  GetFileAttributesExW
  CreateProcessW
  VirtualAlloc
  SetSecurityDescriptorDacl
  OpenProcessToken
  GetVersionExA
  OpenFileMappingA
  GetThreadContext
  GetFileAttributesExA
  accept
  WSAStartup
  connect
  recv
  send
  listen
  closesocket
  socket
  bind
  recvfrom
  sendto
  GetComputerNameA
  OpenProcess
  GetFileAttributesW
  CreateFileMappingW
  GetModuleFileNameExA
  CreateToolhelp32Snapshot
  Process32First
  Process32Next
  StartServiceW
  CreateServiceW
  DeviceIoControl
  LockResource
  FindResourceExW
  FindResourceW
  
  source
  
  Static Parser
  
  relevance
  
  1/10
- Installs hooks/patches the running process
  
  details
  
  "<Input Sample>" wrote bytes "d0556875647371750000000051c1627694986276ee9c627675dc6476273e64760fb368760000000085482976698729760f772b76d9172976ead72a76a9342976f8112976201429760c112976f516297654142976ff1029763214297600000000" to virtual address "0x74701000" (part of module "SHFOLDER.DLL")
  "<Input Sample>" wrote bytes "54421d75de401d759a3f1d75000000003f732b76d38a2b76f81129762e3e2976e0132976ead72a762a882b76f2182a76d9172976f8542976561929762e582976d551297600000000d894487500000000" to virtual address "0x74672000" (part of module "KILLER.DLL")
  "<Input Sample>" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")
  "<Input Sample>" wrote bytes "c2000000" to virtual address "0x0055404C"
  "<Input Sample>" wrote bytes "fe182976f854297657d12a76f2182a76852a2b76221229763e18297668342976eb59297677492976451229762e582976dd16297626182976ff422976c011297600000000d89448750000000008223e76d1e43b7600000000" to virtual address "0x00553000"
  "<Input Sample>" wrote bytes "9c1800004a1800005e1800006c1800007c1800008a1800003c180000ac180000ba1800004019000000000000d4180000de180000f2180000fc180000121900001a1900002619000030190000e81800005c19000000000000" to virtual address "0x00851000"
  "UPEditor.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")
  "UPService.exe" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL")
  "UPService.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")
  "UPService.exe" wrote bytes "ead72a7600000000d4701e75000000001aad1577000000005f3c767600000000bc15137500000000f04829760000000045122976774929765c162976dc2c297681142976b079297600000000" to virtual address "0x00F0B000" (part of module "UPSERVICE.EXE")
  "UPSecurityInput.exe" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL")
  "UPSecurityInput.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")
  "UPSecurityInput.exe" wrote bytes "7d07677781ed6577ae866477c6e06377effd66772d16657760146777478d6477a8e263776089647700000000ad3776768b2d7676b641767600000000" to virtual address "0x74401000" (part of module "WSHTCPIP.DLL")
  "schtasks.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")
  "certutil.exe" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL")
  "certutil.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
- Reads information about supported languages
  
  details
  
  "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
Hiding 11 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version

Informative 29
Anti-Reverse Engineering
- Contains ability to register a top-level exception handler (often used as anti-debugging trick)
  
  details
  
  __crtSetUnhandledExceptionFilter@MSVCR120.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- PE file contains zero-size sections
  
  details
  
  Raw size of ".ndata" is zero
  Raw size of ".text" is zero
  Raw size of ".rdata" is zero
  Raw size of ".data" is zero
  Raw size of ".upx0" is zero
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Environment Awareness
- Contains ability to query the machine version
  
  details
  
  GetVersion@KERNEL32.DLL from UPEditorEdge_1.exe (PID: 3372) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Contains ability to query volume size
  
  details
  
  GetDiskFreeSpaceA@KERNEL32.DLL from UPEditorEdge_1.exe (PID: 3372) (Show Stream)
  GetDiskFreeSpaceA@KERNEL32.dll (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  3/10
- Queries volume information
  
  details
  
  "<Input Sample>" queries volume information of "C:\" at 00013355-00003372-00000046-63801864
  "<Input Sample>" queries volume information of "%WINDIR%\SysWOW64\UPEditNew\UPSecurityInput.exe" at 00013355-00003372-00000046-63900664
  "certutil.exe" queries volume information of "C:\" at 00017695-00002956-00000046-66972563
  "certutil.exe" queries volume information of "%WINDIR%\SysWOW64\UPEditNew\root_bundle.crt" at 00017695-00002956-00000046-66981604
  
  source
  
  API Call
  
  relevance
  
  2/10
- Queries volume information of an entire harddrive
  
  details
  
  "<Input Sample>" queries volume information of "C:\" at 00013355-00003372-00000046-63801864
  "certutil.exe" queries volume information of "C:\" at 00017695-00002956-00000046-66972563
  
  source
  
  API Call
  
  relevance
  
  8/10
- Reads the registry for installed applications
  
  details
  
  "<Input Sample>" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNIONPAY SECURITY NON PLUG 1.0.0.3")
  "<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\UPEDITOREDGE_1.EXE")
  "<Input Sample>" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\UPEDITOREDGE_1.EXE")
  "<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CERTMGR.EXE")
  "<Input Sample>" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CERTMGR.EXE")
  "<Input Sample>" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\UNIONPAY SECURITY NON PLUG")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
External Systems
- Sample was identified as clean by Antivirus engines
  
  details
  
  0/65 Antivirus vendors marked sample as malicious (0% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
General
- Accesses System Certificates Settings
  
  details
  
  "certmgr.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB")
  "certmgr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\132D0D45534B6997CDB2D5C339E25576609B5CC6"; Key: "BLOB")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
- Contacts server
  
  details
  
  "2.21.242.196:80"
  "2.18.213.152:80"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Contains PDB pathways
  
  details
  
  "D:\Work\PassGuard\PassGuard_IE\PassGuard_general\Release\passguardwin7ins.pdb"
  "C:\workdriver\workspace\PassGuard_driver\PassGuard_x86\Release\PassGuard.pdb"
  "C:\workdriver\workspace\IRPHOOK_x64_iocroutine_caps\x64\x64_release\SysEnterHook.pdb"
  "D:\MySvn\PassGuardNew\modifyhost\Release\UPService.pdb"
  "D:\MySvn\PassGuardNew\Release\SecurityInput.pdb"
  "CertMgr.pdb"
  
  source
  
  File/Memory
  
  relevance
  
  1/10
- Contains SQL queries
  
  details
  
  "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);"
  
  source
  
  File/Memory
  
  relevance
  
  2/10
- Creates a writable file in a temporary directory
  
  details
  
  "<Input Sample>" created file "%TEMP%\nsf543C.tmp\modern-header.bmp"
  "<Input Sample>" created file "%TEMP%\nsf543C.tmp\modern-wizard.bmp"
  "<Input Sample>" created file "%TEMP%\nsf543C.tmp\nsDialogs.dll"
  "<Input Sample>" created file "%TEMP%\nsf543C.tmp\System.dll"
  "<Input Sample>" created file "%TEMP%\nsf543C.tmp\killer.dll"
  "<Input Sample>" created file "%TEMP%\nsf543C.tmp\FindProcDLL.dll"
  "<Input Sample>" created file "%TEMP%\nsf543C.tmp\KillProcDLL.dll"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Creates mutants
  
  details
  
  "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
  "Local\ZonesLockedCacheCounterMutex"
  "Local\ZonesCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\DBWinMutex"
  "DBWinMutex"
  "\Sessions\1\BaseNamedObjects\8F22FC5C-8C92-4A21-9052-92C773CBB657"
  "8F22FC5C-8C92-4A21-9052-92C773CBB657"
  
  source
  
  Created Mutant
  
  relevance
  
  3/10
- Drops files marked as clean
  
  details
  
  Antivirus vendors marked dropped file "certmgr.exe" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcr120.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nspr4.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "freebl3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "smime3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "KillProcDLL.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "sqlite3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "plc4.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nssutil3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nss3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "UPService.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "uninst.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"), Antivirus vendors marked dropped file "plds4.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "softokn3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nsDialogs.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "FindProcDLL.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "UPSecurityInput.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "UPEditor.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nssdbm3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")
  
  source
  
  Binary File
  
  relevance
  
  10/10
- Loads rich edit control libraries
  
  details
  
  "<Input Sample>" loaded module "%WINDIR%\SysWOW64\riched20.dll" at 74680000
  
  source
  
  Loaded Module
- Process launched with changed environment
  
  details
  
  Process "UPService.exe" (Show Process) was launched with modified environment variables: "LOCALAPPDATA, TMP, PROCESSOR_ARCHITECTURE, USERDOMAIN, CommonProgramFiles, ProgramFiles, Path, USERPROFILE, TEMP, APPDATA"
  Process "UPService.exe" (Show Process) was launched with missing environment variables: "PROMPT, LOGONSERVER, HOMEPATH, HOMEDRIVE, PROCESSOR_ARCHITEW6432"
  Process "schtasks.exe" (Show Process) was launched with new environment variables: "PROMPT="$P$G", LOGONSERVER="\\HAPUBWS-PC", HOMEPATH="\Users\AHuBiUh", HOMEDRIVE="C:", PROCESSOR_ARCHITEW6432="AMD64""
  Process "schtasks.exe" (Show Process) was launched with modified environment variables: "LOCALAPPDATA, TMP, PROCESSOR_ARCHITECTURE, USERDOMAIN, CommonProgramFiles, ProgramFiles, Path, USERPROFILE, TEMP, APPDATA"
  
  source
  
  Monitored Target
  
  relevance
  
  10/10
- Scanning for window names
  
  details
  
  "<Input Sample>" searching for class "#32770"
  
  source
  
  API Call
  
  relevance
  
  10/10
- Spawns new processes
  
  details
  
  Spawned process "UPEditor.exe" with commandline ""-s"" (Show Process)
  Spawned process "UPService.exe" with commandline ""-install"" (Show Process)
  Spawned process "UPSecurityInput.exe" with commandline "%WINDIR%\system32\UPEditNew\UPSecurityInput.exe" (Show Process)
  Spawned process "UPService.exe" with commandline ""-control" "UPSecurityInputService" "start"" (Show Process)
  Spawned process "UPService.exe" (Show Process)
  Spawned process "schtasks.exe" with commandline "%WINDIR%\system32\schtasks.exe /delete /tn "ÒøÁªÔÚÏß°²È«ÊäÈë³ÌÐò" /f" (Show Process)
  Spawned process "schtasks.exe" with commandline "%WINDIR%\system32\schtasks.exe /create /tn "ÒøÁªÔÚÏß°²È«ÊäÈë³ÌÐò" /tr "%WINDIR%\SysWOW64\UPEditNew\UPSecurityInput.exe" /sc onlogon" (Show Process)
  Spawned process "certutil.exe" with commandline "-A -d "%APPDATA%\Mozilla\Firefox\Profiles\fg6ygf16.default" -i .\root_bundle.crt -n "WoSign Class 1 DV Server CA G2" -t "C
  
  "" (Show Process)
  Spawned process "certmgr.exe" with commandline "-add "%TEMP%\wosign.cer" -c -s -r localMachine Root" (Show Process)
  Spawned process "certmgr.exe" with commandline "-add "%TEMP%\mysign.cer" -c -s -r localMachine CA" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
- The input sample is signed with a certificate
  
  details
  
  The input sample is signed with a certificate issued by "CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US" (SHA1: 03:A5:B1:46:63:EB:12:02:30:91:B8:4A:6D:6A:68:BC:87:1D:E6:6B; see report for more information)
  The input sample is signed with a certificate issued by "CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US" (SHA1: 60:D2:E8:AF:0C:FF:13:6E:3A:C7:FD:12:E1:D4:47:28:33:28:FA:20; see report for more information)
  The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign
  Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign
  Inc.", C=US" (SHA1: 00:77:90:F6:56:1D:AD:89:B0:BC:D8:55:85:76:24:95:E3:58:F8:A5; see report for more information)
  
  source
  
  Certificate Data
  
  relevance
  
  10/10
- The input sample is signed with a valid certificate
  
  details
  
  The entire certificate chain of the input sample was validated successfully.
  
  source
  
  Certificate Data
  
  relevance
  
  10/10
Installation/Persistance
- Connects to LPC ports
  
  details
  
  "<Input Sample>" connecting to "\ThemeApiPort"
  "UPSecurityInput.exe" connecting to "\ThemeApiPort"
  "schtasks.exe" connecting to "\ThemeApiPort"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Dropped files
  
  details
  
  "UnionPay Security Non plug.lnk" has type "empty "
  "certmgr.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
  "msvcr120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "UnionPay Security Non plug.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Archive ctime=Thu Mar 23 04:43:38 2017 mtime=Sat Mar 31 02:18:28 2018 atime=Thu Mar 23 04:43:38 2017 length=4238096 window=hide"
  "nspr4.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "smime3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "KillProcDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "sqlite3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "mysign.cer" has type "PEM certificate"
  "plc4.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "root_bundle.crt" has type "PEM certificate"
  "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nssutil3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "UPService.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
  "certutil.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
  "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive"
  "wosign.cer" has type "PEM certificate"
  "plds4.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  
  source
  
  Binary File
  
  relevance
  
  3/10
- Touches files in the Windows directory
  
  details
  
  "<Input Sample>" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
  "<Input Sample>" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"
  "<Input Sample>" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"
  "<Input Sample>" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui"
  "<Input Sample>" touched file "C:\Windows\Fonts\StaticCache.dat"
  "<Input Sample>" touched file "C:\Windows\SysWOW64"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\UPService.exe"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\UPEditor.exe"
  "<Input Sample>" touched file "C:\Windows\AppPatch\sysmain.sdb"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\UPSecurityInput.exe"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\certutil.exe"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\freebl3.dll"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\msvcr120.dll"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\nspr4.dll"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\nss3.dll"
  "<Input Sample>" touched file "C:\Windows\SysWOW64\UPEditNew\nssdbm3.dll"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Pattern match: "http://nsis.sf.net/NSIS_Error"
  Pattern match: "http://www.usertrust.com1"
  Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05"
  Pattern match: "http://ocsp.usertrust.com0"
  Pattern match: "http://sv.symcb.com/sv.crl0f"
  Pattern match: "https://d.symcb.com/cps0%"
  Pattern match: "https://d.symcb.com/rpa0"
  Pattern match: "http://sv.symcd.com0&"
  Pattern match: "http://sv.symcb.com/sv.crt0"
  Pattern match: "http://s2.symcb.com0"
  Pattern match: "http://www.symauth.com/cps0"
  Pattern match: "http://www.symauth.com/rpa00"
  Pattern match: "http://s1.symcb.com/pca3-g5.crl0"
  Pattern match: "http://genuine.microsoft.com/reporting/XmlEvent.ashx?v=3"
  Pattern match: "http://www.symauth.com/rpa0"
  Pattern match: "http://www.symauth.com/cps0*"
  Pattern match: "http://www.openssl.org/support/faq.html"
  Pattern match: "http://www.macvendorlookup.com/api/v2/"
  Pattern match: "www.macvendorlookup.com"
  Pattern match: "http://192.168.8.72:8080"
  Heuristic match: "windows10.microdone.cn"
  
  source
  
  File/Memory
  
  relevance
  
  10/10
System Security
- Creates or modifies windows services
  
  details
  
  "UPService.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
- Opens the Kernel Security Device Driver (KsecDD) of Windows
  
  details
  
  "<Input Sample>" opened "\Device\KsecDD"
  "UPSecurityInput.exe" opened "\Device\KsecDD"
  "schtasks.exe" opened "\Device\KsecDD"
  "certutil.exe" opened "\Device\KsecDD"
  "certmgr.exe" opened "\Device\KsecDD"
  
  source
  
  API Call
  
  relevance
  
  10/10
Unusual Characteristics
- Matched Compiler/Packer signature
  
  details
  
  "UPEditorEdge_1.exe.bin" was detected as "Nullsoft PiMP Stub -> SFX"
  "certmgr.exe" was detected as "VC8 -> Microsoft Corporation"
  "msvcr120.dll" was detected as "Borland Delphi 3.0 (???)"
  "nspr4.dll" was detected as "Borland Delphi 3.0 (???)"
  "freebl3.dll" was detected as "Borland Delphi 3.0 (???)"
  "smime3.dll" was detected as "Borland Delphi 3.0 (???)"
  "KillProcDLL.dll" was detected as "Microsoft visual C++ 6.0 DLL"
  "sqlite3.dll" was detected as "Borland Delphi 3.0 (???)"
  "plc4.dll" was detected as "Borland Delphi 3.0 (???)"
  "nssutil3.dll" was detected as "Borland Delphi 3.0 (???)"
  "nss3.dll" was detected as "Borland Delphi 3.0 (???)"
  "certutil.exe" was detected as "VC8 -> Microsoft Corporation"
  "uninst.exe" was detected as "Nullsoft PiMP Stub -> SFX"
  "plds4.dll" was detected as "Borland Delphi 3.0 (???)"
  "softokn3.dll" was detected as "Borland Delphi 3.0 (???)"
  "UPEditor.exe" was detected as "VC8 -> Microsoft Corporation"
  "nssdbm3.dll" was detected as "Borland Delphi 3.0 (???)"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Uses certutil from the Windows Certificate Services
  
  details
  
  Process "certutil.exe" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  10/10

File Details

All Details:

UPEditorEdge_1.exe

Filename: UPEditorEdge_1.exe
Size: 6.5MiB (6860016 bytes)
Type: peexe executable
Description: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Architecture
: WINDOWS
SHA256
: 4b6e96cc8167657d2c92b050008dcbefee9356dc986da24dcfce1ccf4a0f5e27
MD5
: 97ba111fe5ea891d97d429a79b32f718
SHA1
: b890d5087e1b66cd97668e61d6e5291b3509d260
ssdeep
: 196608:41qb1cMI4oiEh7flaBOtIJR2TMw4fG7J4ATz:/2Mx+7fkpREJ4az
imphash
: e160ef8e55bb9d162da4e266afd9eef3
authentihash
: 4e53f54a6459588de9ea6264b095713c6b60454c4edcf7f83174beaedf32faaa
Compiler/Packer
: Nullsoft PiMP Stub -> SFX

Resources

Language
: ENGLISH
Icon

Visualization

Input File (PortEx)

Version Info

LegalCopyright: (C) 2017 China UnionPay copyright reserved.
FileVersion: 1.0.0.4
CompanyName: China UnionPay
ProductName: UnionPay Security Control
ProductVersion: 1.0.0.4
FileDescription: UnionPay Security Control
Translation: 0x0c04 0x03b6

Classification (TrID)

91.9% (.EXE) NSIS - Nullsoft Scriptable Install System
3.3% (.EXE) Win32 Executable MS Visual C++ (generic)
3.0% (.EXE) Win64 Executable (generic)
0.7% (.DLL) Win32 Dynamic Link Library (generic)
0.4% (.EXE) Win32 Executable (generic)

File Metadata

1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 1735)
10 .C Files compiled with CL.EXE (Visual Studio 6 Processor Pack) (build: 9044)
17 .LIB Files generated with LIB.EXE 7.10 (Visual Studio .NET 2003) (build: 4035)

2 .C Files compiled with CL.EXE 13.10 (Visual Studio .NET 2003) (build: 4035)

File Sections

Details	Name	Entropy	Virtual Address	Virtual Size	Raw Size	MD5	Characteristics
Name .text Entropy 6.4186984047 Virtual Address 0x1000 Virtual Size 0x5a68 Raw Size 0x5c00 MD5 e50f4a1111bafdc813b1f7ec153b8ea9	.text	6.4186984047	0x1000	0x5a68	0x5c00	e50f4a1111bafdc813b1f7ec153b8ea9	-
Name .rdata Entropy 5.23558258678 Virtual Address 0x7000 Virtual Size 0x11ce Raw Size 0x1200 MD5 640f709ec19b4ed0455a4c64e5934d5e	.rdata	5.23558258678	0x7000	0x11ce	0x1200	640f709ec19b4ed0455a4c64e5934d5e	-
Name .data Entropy 4.87122636881 Virtual Address 0x9000 Virtual Size 0x1a7b8 Raw Size 0x400 MD5 54c75104a38a6f79dc7a8d3b020a9139	.data	4.87122636881	0x9000	0x1a7b8	0x400	54c75104a38a6f79dc7a8d3b020a9139	-
Name .ndata Entropy 0 Virtual Address 0x24000 Virtual Size 0x11000 Raw Size 0x0 MD5 d41d8cd98f00b204e9800998ecf8427e	.ndata	0	0x24000	0x11000	0x0	d41d8cd98f00b204e9800998ecf8427e	-
Name .rsrc Entropy 4.80540380062 Virtual Address 0x35000 Virtual Size 0x9a60 Raw Size 0x9c00 MD5 2481e8c9cb619970f415ca6ca7fe5a27	.rsrc	4.80540380062	0x35000	0x9a60	0x9c00	2481e8c9cb619970f415ca6ca7fe5a27	-

File Resources

Details	Name	RVA	Size	Type	Language
Name RT_ICON RVA 0x35430 Size 0x4228 Type dBase IV DBT of \200.DBF, blocks size 64, block length 16896, next free block index 40, 1st item "\377\377\377" Language English	RT_ICON	0x35430	0x4228	dBase IV DBT of \200.DBF, blocks size 64, block length 16896, next free block index 40, 1st item "\377\377\377"	English
Name RT_ICON RVA 0x39658 Size 0x25a8 Type data Language English	RT_ICON	0x39658	0x25a8	data	English
Name RT_ICON RVA 0x3bc00 Size 0x10a8 Type data Language English	RT_ICON	0x3bc00	0x10a8	data	English
Name RT_DIALOG RVA 0x3cca8 Size 0x200 Type data Language English	RT_DIALOG	0x3cca8	0x200	data	English
Name RT_DIALOG RVA 0x3cea8 Size 0xf8 Type data Language English	RT_DIALOG	0x3cea8	0xf8	data	English
Name RT_DIALOG RVA 0x3cfa0 Size 0xee Type data Language English	RT_DIALOG	0x3cfa0	0xee	data	English
Name RT_DIALOG RVA 0x3d090 Size 0x1ec Type data Language English	RT_DIALOG	0x3d090	0x1ec	data	English
Name RT_DIALOG RVA 0x3d280 Size 0xe4 Type data Language English	RT_DIALOG	0x3d280	0xe4	data	English
Name RT_DIALOG RVA 0x3d368 Size 0xda Type data Language English	RT_DIALOG	0x3d368	0xda	data	English
Name RT_DIALOG RVA 0x3d448 Size 0x1f0 Type data Language English	RT_DIALOG	0x3d448	0x1f0	data	English
Name RT_DIALOG RVA 0x3d638 Size 0xe8 Type data Language English	RT_DIALOG	0x3d638	0xe8	data	English
Name RT_DIALOG RVA 0x3d720 Size 0xde Type data Language English	RT_DIALOG	0x3d720	0xde	data	English
Name RT_DIALOG RVA 0x3d800 Size 0x1f0 Type data Language English	RT_DIALOG	0x3d800	0x1f0	data	English
Name RT_DIALOG RVA 0x3d9f0 Size 0xe8 Type data Language English	RT_DIALOG	0x3d9f0	0xe8	data	English
Name RT_DIALOG RVA 0x3dad8 Size 0xde Type data Language English	RT_DIALOG	0x3dad8	0xde	data	English
Name RT_GROUP_ICON RVA 0x3dbb8 Size 0x30 Type MS Windows icon resource - 3 icons, 32x32, 256-colors Language English	RT_GROUP_ICON	0x3dbb8	0x30	MS Windows icon resource - 3 icons, 32x32, 256-colors	English
Name RT_VERSION RVA 0x3dbe8 Size 0x2b8 Type COM executable for DOS Language Chinese	RT_VERSION	0x3dbe8	0x2b8	COM executable for DOS	Chinese
Name RT_VERSION RVA 0x3dea0 Size 0x2b8 Type COM executable for DOS Language English	RT_VERSION	0x3dea0	0x2b8	COM executable for DOS	English
Name RT_VERSION RVA 0x3e158 Size 0x258 Type data Language Chinese	RT_VERSION	0x3e158	0x258	data	Chinese
Name RT_VERSION RVA 0x3e3b0 Size 0x2b8 Type COM executable for DOS Language Chinese	RT_VERSION	0x3e3b0	0x2b8	COM executable for DOS	Chinese
Name RT_MANIFEST RVA 0x3e668 Size 0x3f5 Type XML document text Language English	RT_MANIFEST	0x3e668	0x3f5	XML document text	English

File Imports

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegDeleteValueA

RegEnumKeyA

RegEnumValueA

RegOpenKeyExA

RegQueryValueExA

RegSetValueExA

ImageList_AddMasked

ImageList_Create

ImageList_Destroy

CreateBrushIndirect

CreateFontIndirectA

DeleteObject

GetDeviceCaps

SelectObject

SetBkColor

SetBkMode

SetTextColor

CloseHandle

CompareFileTime

CopyFileA

CreateDirectoryA

CreateFileA

CreateProcessA

CreateThread

DeleteFileA

ExitProcess

ExpandEnvironmentStringsA

FindClose

FindFirstFileA

FindNextFileA

FreeLibrary

GetCommandLineA

GetCurrentProcess

GetDiskFreeSpaceA

GetExitCodeProcess

GetFileAttributesA

GetFileSize

GetFullPathNameA

GetLastError

GetModuleFileNameA

GetModuleHandleA

GetPrivateProfileStringA

GetProcAddress

GetShortPathNameA

GetSystemDirectoryA

GetTempFileNameA

GetTempPathA

GetTickCount

GetVersion

GetWindowsDirectoryA

GlobalAlloc

GlobalFree

GlobalLock

GlobalUnlock

LoadLibraryA

LoadLibraryExA

lstrcatA

lstrcmpA

lstrcmpiA

lstrcpyA

lstrcpynA

lstrlenA

MoveFileA

MulDiv

MultiByteToWideChar

ReadFile

RemoveDirectoryA

SearchPathA

SetCurrentDirectoryA

SetEnvironmentVariableA

SetErrorMode

SetFileAttributesA

SetFilePointer

SetFileTime

Sleep

WaitForSingleObject

WriteFile

WritePrivateProfileStringA

CoCreateInstance

CoTaskMemFree

OleInitialize

OleUninitialize

SHBrowseForFolderA

ShellExecuteA

SHFileOperationA

SHGetFileInfoA

SHGetPathFromIDListA

SHGetSpecialFolderLocation

AppendMenuA

BeginPaint

CallWindowProcA

CharNextA

CharPrevA

CheckDlgButton

CloseClipboard

CreateDialogParamA

CreatePopupMenu

CreateWindowExA

DefWindowProcA

DestroyWindow

DialogBoxParamA

DispatchMessageA

DrawTextA

EmptyClipboard

EnableMenuItem

EnableWindow

EndDialog

EndPaint

ExitWindowsEx

FillRect

FindWindowExA

GetClassInfoA

GetClientRect

GetDC

GetDlgItem

GetDlgItemTextA

GetMessagePos

GetSysColor

GetSystemMenu

GetSystemMetrics

GetWindowLongA

GetWindowRect

InvalidateRect

IsWindow

IsWindowEnabled

IsWindowVisible

LoadBitmapA

LoadCursorA

LoadImageA

MessageBoxIndirectA

OpenClipboard

PeekMessageA

PostQuitMessage

RegisterClassA

ReleaseDC

ScreenToClient

SendMessageA

SendMessageTimeoutA

SetClassLongA

SetClipboardData

SetCursor

SetDlgItemTextA

SetForegroundWindow

SetTimer

SetWindowLongA

SetWindowPos

SetWindowTextA

ShowWindow

SystemParametersInfoA

TrackPopupMenu

wsprintfA

GetFileVersionInfoA

GetFileVersionInfoSizeA

VerQueryValueA

File Certificates

Certificate chain was successfully validated.

Download Certificate File (6.3KiB)

Owner	Issuer	Validity	Hashes (MD5, SHA1)
CN=COMODO SHA-1 Time Stamping Signer, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US Serial: 1688f039255e638e69143907e6330b	12/31/2015 01:00:00 07/09/2019 20:40:36	8F:C6:01:B2:F5:01:26:30:60:AC:8D:52:9D:37:A2:94 03:A5:B1:46:63:EB:12:02:30:91:B8:4A:6D:6A:68:BC:87:1D:E6:6B
CN="China UnionPay Co.,Ltd.", OU=product innovation, O="China UnionPay Co.,Ltd.", L=shanghai, ST=shanghai, C=CN	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US Serial: 1f5e46e3b8c0b8c33918e7cb4be3a31d	06/08/2015 02:00:00 07/08/2018 01:59:59	20:81:5E:58:22:2B:95:51:25:40:2D:82:40:98:FB:D4 60:D2:E8:AF:0C:FF:13:6E:3A:C7:FD:12:E1:D4:47:28:33:28:FA:20
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US	CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US Serial: 3d78d7f9764960b2617df4f01eca862a	12/10/2013 01:00:00 12/10/2023 00:59:59	19:74:60:A7:09:D4:F4:C8:FA:C4:B9:E3:32:20:54:34 00:77:90:F6:56:1D:AD:89:B0:BC:D8:55:85:76:24:95:E3:58:F8:A5

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 11 processes in total (System Resource Monitor).

UPEditorEdge_1.exe (PID: 3372)
- UPEditor.exe "-s" (PID: 2184) Hash Seen Before
- UPService.exe "-install" (PID: 2584) Hash Seen Before
- UPSecurityInput.exe %WINDIR%\system32\UPEditNew\UPSecurityInput.exe (PID: 2328) Hash Seen Before
  - schtasks.exe %WINDIR%\system32\schtasks.exe /delete /tn "ÒøÁªÔÚÏß°²È«ÊäÈë³ÌÐò" /f (PID: 2424) Hash Seen Before
  - schtasks.exe %WINDIR%\system32\schtasks.exe /create /tn "ÒøÁªÔÚÏß°²È«ÊäÈë³ÌÐò" /tr "%WINDIR%\SysWOW64\UPEditNew\UPSecurityInput.exe" /sc onlogon (PID: 3792) Hash Seen Before
  - certutil.exe -A -d "%APPDATA%\Mozilla\Firefox\Profiles\fg6ygf16.default" -i .\root_bundle.crt -n "WoSign Class 1 DV Server CA G2" -t "C,," (PID: 2956) 1/76 Hash Seen Before
- UPService.exe "-control" "UPSecurityInputService" "start" (PID: 2340) Hash Seen Before
- certmgr.exe -add "%TEMP%\wosign.cer" -c -s -r localMachine Root (PID: 3184) Hash Seen Before
- certmgr.exe -add "%TEMP%\mysign.cer" -c -s -r localMachine CA (PID: 2444) Hash Seen Before
UPService.exe (PID: 1080)

Logged Script Calls	Logged Stdout	Extracted Streams	Memory Dumps
Reduced Monitoring	Network Activityy	Network Error	Multiscan Match

Network Analysis

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

IP Address	Port/Protocol	Associated Process	Details
2.21.242.196	80 TCP	watadminsvc.exe PID: 1752	European Union
2.18.213.152	80 TCP	watadminsvc.exe PID: 1752	European Union

Contacted Countries

HTTP Traffic

No relevant HTTP requests were made.

Memory Forensics

String	Context	Stream UID
1.2.3.4	Domain/IP reference	00017695-00002956-65396-43-013E9760
windows10.microdone.cn	Domain/IP reference	00016014-00002328-57689-4632-00185240
2.5.29.1	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.21	Domain/IP reference	00019421-00002444-13514-25-011C785C
http://www.openssl.org/support/faq.html	Domain/IP reference	00016014-00002328-57689-2503-001DE880
11.2.1.10	Domain/IP reference	00019421-00002444-13514-31-011C71DF
1.0.1.3	Domain/IP reference	00016014-00002328-57689-4209-001724F0
49.1.9.15	Domain/IP reference	00019421-00002444-13514-20-011C6926
1.0.1.1	Domain/IP reference	00016014-00002328-57689-4209-001724F0
2.5.29.15	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.14	Domain/IP reference	00019421-00002444-13514-20-011C6926
1.3.6.1	Domain/IP reference	00019421-00002444-13514-65-011C5DA9
http://nsis.sf.net/nsis_error	Domain/IP reference	00013355-00003372-31802-56-00402C29
2.5.29.10	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.31	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.32	Domain/IP reference	00019421-00002444-13514-20-011C6926
www.macvendorlookup.com	Domain/IP reference	00016014-00002328-57689-4037-00186000
2.5.29.37	Domain/IP reference	00019421-00002444-13514-88-011C37FB
2.5.29.19	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.18	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.35	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.17	Domain/IP reference	00019421-00002444-13514-20-011C6926
49.1.9.5	Domain/IP reference	00019421-00002444-13514-65-011C5DA9
http://www.macvendorlookup.com/api/v2/	Domain/IP reference	00016014-00002328-57689-4037-00186000
2.5.29.7	Domain/IP reference	00019421-00002444-13514-20-011C6926
11.2.1.27	Domain/IP reference	00019421-00002444-13514-30-011C7053
49.1.9.6	Domain/IP reference	00019421-00002444-13514-65-011C5DA9
2.5.29.8	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.2	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.29.4	Domain/IP reference	00019421-00002444-13514-20-011C6926
2.5.4.3	Domain/IP reference	00019421-00002444-13514-20-011C6926
11.2.1.26	Domain/IP reference	00019421-00002444-13514-20-011C6926
http://192.168.8.72:8080	Domain/IP reference	00016014-00002328-57689-4037-00186000
1.0.0.4	Domain/IP reference	00016014-00002328-57689-3758-00188240
1.0.1.8	Domain/IP reference	00014848-00002184-45829-166-008B1F30
1.0.0.3	Domain/IP reference	00013355-00003372-31802-4-00405425

Extracted Strings

Download All Memory Strings (84KiB)

!*CNUD'G@

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!0"X-\-U_

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!:\9IDPV7v

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!^+uSC :&

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!_z1$-OC

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!COMODO SHA-1 Time Stamping Signer0

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!eWtN7\KB

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!expected_len || s->s3->previous_client_finished_len

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

!expected_len || s->s3->previous_server_finished_len

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

!h$.Q$U1e6uR

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!hcK+dbF&

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

!Invalid AVA!

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E0000.00000002.mdmp)

!J"`i@Q2{Q9Z;

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!l;~u.#p|

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!This program cannot be run in DOS mode.$

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!xSF0}\n-

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

!ZDq{^Q(I

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

" -i .\root_bundle.crt -n "WoSign Class 1 DV Server CA G2" -t "C,,"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

" /sc onlogon

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

""""""""""""""

Ansi based on Memory/File Scan (certmgr.exe , 00018812-00003184.00000000.19135.00BCC000.00000002.mdmp)

"%s" [%s]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

","default_language":"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

","gmt_time":"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

","os_name_version":"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

","screen_resolution":[

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

","time_zone":"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

"-control" "UPSecurityInputService" "start"

Ansi based on Process Commandline (UPService.exe)

"-install"

Ansi based on Process Commandline (UPService.exe)

"2-=6*Wn

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

"9Q6GEw9e

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

"],"bios_sn":"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

"C8}<Xei

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

"C:\UPEditorEdge_1.exe"

Ansi based on Hybrid Analysis (UPEditorEdge_1.exe , 00013355-00003372.00000002.17518.00401000.00000020.mdmp)

"%WINDIR%\system32\UPEditNew\UPService.exe" "-control" "UPSecurityInputService" "start"

Ansi based on Hybrid Analysis (UPEditorEdge_1.exe , 00013355-00003372.00000002.17518.00401000.00000020.mdmp)

"%WINDIR%\system32\UPEditNew\UPService.exe" "-install"

Ansi based on Hybrid Analysis (UPEditorEdge_1.exe , 00013355-00003372.00000001.15598.00401000.00000020.mdmp)

"company"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

"d'N}V[{r

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

"RouterMac":"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

"RouterVendor":"

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

"W6zCnUJ\<

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

# `GM&)gY

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#+'>[_#&YZ!

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#,<TZpwhQ)9

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#/)}j(([D

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#4]Gm84LY

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#<^g/66,!

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#@~|1DWb

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#],Y|Ur.

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#]`4LT[^tL1qA

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#Ar^t pOL4

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#jrhO0TW>

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

#UtKx$i2QJ

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

$0dgXQ2V#

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

$3wU[{Oiib

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

$858#<G=u=

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.005D4000.00000080.mdmp)

$@.\crypto\bio\b_print.c

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

$Rzi8xx[3

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

$vxic&n.d1P

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

$~/)&(C^$Ebw6

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%')s-:me?

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%*s%s:%*s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*s<EMPTY>

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sCPS: %s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sCRL Issuer:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*scrlNum:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*scrlTime:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*scrlUrl:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*sExplicit Text: %s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sFull Name:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sIndirect CRL

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sIssuer:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*sNumber%s:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sOnly Attribute Certificates

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sOnly CA Certificates

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sOnly User Certificates

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sOrganization: %s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sPath Length Constraint:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*sPolicy Language:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*sPolicy Text: %s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*sPolicy:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sRelative Name:%*s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sUnknown Qualifier:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sUser Notice:

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%*sVersion: %ld (0x%lX)

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%*sZone: %s, User:

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%-15s Add a certificate to the database (create if needed)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Add an Email certificate to the database (create if needed)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Change the database nickname of a certificate

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Change the key database password

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Create a new binary certificate from a BINARY cert request

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Create a new certificate database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Delete a certificate from the database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Delete a key from the database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Generate a certificate request (stdout)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Generate a new key pair

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s List all certs, or print out a single named cert (or a subset)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s List all modules

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s List all private keys

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Make a certificate and add to database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Merge source database into the target database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Modify trust attributes of certificate

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Print the chain of a certificate

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Reset the Key database or token

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Run a series of certutil commands from a batch file

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Upgrade an old database and merge it into a new one

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-15s Validate a certificate

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s other, registerid, rfc822, uri, x400, x400addr

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Add one or multiple extensions that certutil cannot encode yet,%-20s by loading their encodings from external files.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Cert & Key database prefix of the source database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Cert & Key database prefix of the upgrade database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Cert database directory of the source database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Cert database directory to upgrade from

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Create a Subject Alt Name extension with one or multiple names

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Create extended key usage extension. Possible keywords:%-20s "serverAuth", "clientAuth","codeSigning",%-20s "emailProtection", "timeStamp","ocspResponder",%-20s "stepUp", "msTrustListSign", "critical"

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Create key usage extension. Possible keywords:%-20s "digitalSignature", "nonRepudiation", "keyEncipherment",%-20s "dataEncipherment", "keyAgreement", "certSigning",%-20s "crlSigning", "critical"

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Create netscape cert type extension. Possible keywords:%-20s "sslClient", "sslServer", "smime", "objectSigning",%-20s "sslCA", "smimeCA", "objectSigningCA", "critical".

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s For single cert, print binary DER encoding of extension OID

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Name of the token while it is in upgrade state

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Pretty print cert with email address (list all if unspecified)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Specify the hash algorithm to use. Possible keywords:%-20s "MD2", "MD4", "MD5", "SHA1", "SHA224",%-20s "SHA256", "SHA384", "SHA512"

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s %-20s Unique identifier for the upgrade database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s - critical-flag: critical or not-critical

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s - filename: full path to a file containing an encoded extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s - OID (example): 1.2.3.4

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s - type: directory, dn, dns, edi, ediparty, email, ip, ipaddr,

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Cert & Key database prefix

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Cert & Key database prefix of the target database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s cert and key database directory

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Cert database directory (default is ~/.netscape)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Cert database directory of target (default is ~/.netscape)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Cert database directory to merge into (default is ~/.netscape)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Cert serial number

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Check certificate signature

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Comma separated list of key attribute attribute flags,

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Comma separated list of one or more of the following:

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create a Certificate Policies extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create a DNS subject alt name extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create a name constraints extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create a Policy Constraints extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create a Policy Mappings extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create a Subject Information Access extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create a subject key ID extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create an Authority Information Access extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create an dns subject alt name extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create an email subject alt name extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create an Inhibit Any Policy extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create authority key ID extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create basic constraint extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create crl distribution point extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create extended key usage extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create key usage extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Create netscape cert type extension

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Elliptic curve name (ec only)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s encrypt, decrypt, sign, sign_recover, verify,

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s For single cert, print ASCII encoding (RFC1113)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s For single cert, print binary DER encoding

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s force the database to open R/W

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Input the certificate in ASCII (RFC1113); default is binary

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Key database directory (default is ~/.netscape)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Key size in bits, (min %d, max %d, default %d) (not for ec)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Key size in bits, RSA keys only (min %d, max %d, default %d)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Key type ("all" (default), "dsa", "ec", "rsa")

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Module database directory (default is '~/.netscape')

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Months valid (default is 3)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Name of file containing PQG parameters (dsa only)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Name of token in which to generate key (default is internal)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Name of token to search ("all" for all tokens)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s One of nistp256, nistp384, nistp521

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s or nickname of the cert key to use

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Output binary cert to this file (default is stdout)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Output the cert request in ASCII (RFC1113); default is binary

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Output the cert request to this file

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Pretty print named cert (list all if unspecified)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s read PQG value from pqgfile (dsa only)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s See the "-G" option for a full list of supported names.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s selected from the following list of choices:

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Self sign

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Set the certificate trust attributes (see -A above)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Set the certificate trust attributes:

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Set the public exponent value (3, 17, 65537) (rsa only)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Set token's Site Security Officer password

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify a file with the current password

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify a file with the new password in two lines

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify certificate usage:

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the batch file

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the certificate file (default is stdin)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the contact phone number ("123-456-7890")

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the nickname of the cert

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the nickname of the certificate to add

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the noise file to be used

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the password file

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the password file for the source database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the password file for the target database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the password file for the upgrade database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Specify the subject name (using RFC1485)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The BINARY certificate request file

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The input certificate is encoded in ASCII (RFC1113)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The input certificate request is encoded in ASCII (RFC1113)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The new nickname of the cert to rename

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The nickname of the cert to delete

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The nickname of the cert to modify

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The nickname of the cert to Validate

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The nickname of the issuer cert

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The nickname of the key or associated certificate

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The nickname of the key to delete

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s The old nickname of the cert to rename

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Time Warp

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Token to reset (default is internal)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s Type of key pair to generate ("dsa", "ec", "rsa" (default))

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s use empty password when creating a new database

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s validity time ("YYMMDDHHMMSS[+HHMM|-HHMM|Z]")

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s verify_recover, wrap, unwrap, derive

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s {modifiable | unmodifiable} {extractable | unextractable}

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s {token | session} {public | private} {sensitive | insensitive}

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s%-20s PKCS #11 key Attributes.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-20s%-20s PKCS #11 key Operation Flags.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-23s %s Kx=%-8s Au=%-4s Enc=%-9s Mac=%-4s%s

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%-25s A Any CA

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s and z is for code signing. Use ,, for no explicit trust.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s C SSL Client

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s C trusted CA to issue server certs (implies c)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s c valid CA

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s g make step-up cert

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s J Object signer

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s L SSL CA

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s O OCSP status responder

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s p prohibited (explicitly distrusted)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s P trusted peer

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s R Email Recipient

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s S Email signer

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s T trusted CA to issue client certs (implies c)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s trustargs is of the form x,y,z where x is for SSL, y is for S/MIME,

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s u user cert

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s V SSL Server

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s w send warning

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-25s Y Verify CA

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-60s %-5s

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%-60s %-5s%-60s %-5s

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%.900s/%s

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%02d%02d%02d%02d%02d%02dZ

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%02X-%02X-%02X-%02X-%02X-%02X

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%04d%02d%02d%02d%02d%02d

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

%04d%02d%02d%02d%02d%02dZ

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%04d%02d%02d-%02d:%02d:%02d.%-06d

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%08X.dmp

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%>r/Vbo#w

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%a %b %d %H:%M:%S %Y

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%APPDATA%\Mozilla\Firefox\Profiles\

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%APPDATA%\SecurityInput

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%ASGIOt$J{

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%d =========="==============CTL # %d ==========)==============No Certificates ==========!==============No CTLs ==========

Unicode based on Memory/File Scan (certmgr.exe , 00018812-00003184.00000000.19135.00BCC000.00000002.mdmp)

%d values for %d columns

Ansi based on Dropped File (sqlite3.dll.1014515390)

%d,maxlen %d

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%d.%d.%d.%d

Unicode based on Hybrid Analysis (UPEditor.exe , 00014848-00002184.00000000.15170.008B1000.00000020.mdmp)

%d.%d.%d.%d/%d.%d.%d.%d

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%d: AcceptProc socket

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%FF t9ndY

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%fQIHE\XA

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%HhOKfL~=I

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%io~DFy`y

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%j!R63f#C

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%lu:%s:%s:%d:%s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%r %s BY term out of range - should be between 1 and %d

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s %2d %02d:%02d:%02d%.*s %d%s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%s %s%lu (%s0x%lx)

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%s %T cannot reference objects in database %s

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s (rowid<?)

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s (rowid=?)

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s (rowid>? AND rowid<?)

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s (rowid>?)

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s (SHA-256):

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E0000.00000002.mdmp)

%s (SHA1):

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E0000.00000002.mdmp)

%s (~%lld rows)

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s - Utility to manipulate NSS certificate databasesUsage: %s <command> -d <database-directory> <options>Valid commands:

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -%c: cannot use "-h all" for this command.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -%c: cannot use "-k all" for this command.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -%c: nickname is required for this command (-n).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -%c: subject is required to create a cert request.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -%c: trust is required for this command (-t).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s --merge --source-dir sourceDBDir [-d targetDBdir]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s --merge: specify an source database directory (--source-dir)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s --rename -n cert-name --new-n new-cert-name [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s --rename: specify an old nickname (-n) and a new nickname (--new-n).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s --upgrade-merge --source-dir upgradeDir --upgrade-id uniqueID

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s --upgrade-merge: specify an upgrade database directory (--source-dir) and an upgrade ID (--upgrade-id).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -A -n cert-name -t trustargs [-d certdir] [-P dbprefix] [-a] [-i input]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -B -i batch-file

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -C [-c issuer-name | -x] -i cert-request-file -o cert-file [-m serial-number] [-w warp-months] [-v months-valid] [-f pwfile] [-d certdir] [-P dbprefix] [-Z hashAlg] [-1 | --keyUsage [keyUsageKeyword,..]] [-2] [-3] [-4] [-5 | --nsCertType [nsCertTypeKeyword,...]] [-6 | --extKeyUsage [extKeyUsageKeyword,...]] [-7 emailAddrs] [-8 dns-names] [-a]

Ansi based on Memory/File Scan (certutil.exe , 00017695-00002956.00000000.18017.013F1000.00000002.mdmp)

%s -certVersion: incorrect certificate version %d.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -D -n cert-name [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -E -n cert-name -t trustargs [-d certdir] [-P dbprefix] [-a] [-i input]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -F -n nickname [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -G -n key-name [-h token-name] [-k rsa] [-g key-size] [-y exp] [-f pwfile] [-z noisefile] [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -G [-h token-name] -k dsa [-q pqgfile -g key-size] [-f pwfile] [-z noisefile] [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -G [-h token-name] -k ec -q curve [-f pwfile] [-z noisefile] [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -g: Keysize must be between %d and %d.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -H <command> : Print available options for the given command%s -H : Print complete help output of all commands and options%s --syntax : Print a short summary of all commands and options

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -K [-n key-name] [-h token-name] [-k dsa|ec|rsa|all]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -L [-n cert-name] [-h token-name] [--email email-address]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -M -n cert-name -t trustargs [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -m: %s is not a valid serial number.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -O -n cert-name [-X] [-d certdir] [-a] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -q: specifies a PQG file for DSA keys (-k dsa) or a named curve for EC keys (-k ec))

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -R -s subj -o cert-request-file [-d certdir] [-P dbprefix] [-p phone] [-a] [-7 emailAddrs] [-k key-type-or-id] [-h token-name] [-f pwfile] [-g key-size] [-Z hashAlg]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -S -n cert-name -s subj [-c issuer-name | -x] -t trustargs [-k key-type-or-id] [-q key-params] [-h token-name] [-g key-size] [-m serial-number] [-w warp-months] [-v months-valid] [-f pwfile] [-d certdir] [-P dbprefix] [-Z hashAlg] [-p phone] [-1] [-2] [-3] [-4] [-5] [-6] [-7 emailAddrs] [-8 DNS-names] [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA] [--extSKID] [--extNC] [--extSAN type:name[,type:name]...] [--extGeneric OID:critical-flag:filename[,OID:critical-flag:filename]...]

Ansi based on Memory/File Scan (certutil.exe , 00017695-00002956.00000000.18017.013F1000.00000002.mdmp)

%s -s: improperly formatted name: "%s"

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -S: must specify issuer (-c) or self-sign (-x).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -U [-X] [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -V -n cert-name -u usage [-b time] [-e] [-a][-X] [-d certdir] [-P dbprefix]

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -v: incorrect validity period: "%s"

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -V: specify a usage to validate the cert for (-u).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -y: incorrect public exponent %d.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s -Z: %s is not a recognized type.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s failed to run.

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%s failed to stop.

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%s installed.

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%s is neither a key-type nor a nickname

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s removed

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%s running.

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%s stopped.

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%s SUBQUERY %d

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s Subtree:

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E0000.00000002.mdmp)

%s TABLE %s

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s USING %s%sINDEX%s%s%s

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s USING INTEGER PRIMARY KEY

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s VIRTUAL TABLE INDEX %d:%s

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s%c%08lx.%s%d

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

%s(%d), oserror = %d

Ansi based on Dropped File (plc4.dll.1354026019)

%s(%d): OpenSSL internal error, assertion failed: %s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%s-mjXXXXXX9XXz

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s.%s may not be NULL

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s: no batch input file specified.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: unable to open "%s" for reading (%ld, %ld).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: unable to open "%s" for writing (%ld, %ld).

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: %d (0x%x)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: %s.%s

Ansi based on Dropped File (sqlite3.dll.1014515390)

%s: (%d bit)

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

%s: (null)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: cannot specify both -r and -a when dumping cert.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: certificate is invalid: %s

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: certificate is valid

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: Checking token "%.33s" in slot "%.65s"

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: Could not merge object %s (type %s): %s

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: nickname is required to dump cert in raw or ascii mode.

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: no keys found

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: only one command at a time!

Ansi based on Memory/File Scan (certutil.exe , 00017695-00002956.00000000.18017.013F1000.00000002.mdmp)

%s: PORT_Realloc(%ld) failed

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s: unable to create cert (%s)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

%s:%d pid %d %s %s

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

%s:%d: rec->data != rec->input

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

%SystemDrive%\Users\%OSUSER%\AppData\Local\Temp\certmgr.exe

Unicode based on Runtime Data (UPEditorEdge_1.exe )

%u.%u%s%s

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

%windir%\system32\drivers\etc\hosts

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

%WINDIR%\system32\schtasks.exe /create /tn "ÃÃ¸ÃÂªÃÃÃÃÂ°Â²ÃÂ«ÃÃ¤ÃÃ«Â³ÃÃÃ²" /tr "%WINDIR%\SysWOW64\UPEditNew\UPSecurityInput.exe" /sc onlogon

Ansi based on Process Commandline (schtasks.exe)

%WINDIR%\system32\schtasks.exe /delete /tn "ÃÃ¸ÃÂªÃÃÃÃÂ°Â²ÃÂ«ÃÃ¤ÃÃ«Â³ÃÃÃ²" /f

Ansi based on Process Commandline (schtasks.exe)

%WINDIR%\system32\UPEditNew\UPSecurityInput.exe

Ansi based on Process Commandline (UPSecurityInput.exe)

&3o6r:-;j;

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.005D4000.00000080.mdmp)

&9JX]cb\t

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&9y=dcT=6

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&;?xx~!iF

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&<XF<&[JR

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&DdN~fJHD

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&g?7~xvd;

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&hT2hIp3"

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&iM0>"3f5

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&kaks_VaE`

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&Microsoft Visual C++ Runtime Library

Unicode based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

&V^z"BrV2

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

&~lnU]=+=

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

' is not a number.

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

'()+,-./:=?

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

'*SP(oZ\

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'+(>7H(NA

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

',R'Z9YMn?

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'CI:?s&$:

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'e?(=JPN4o

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'id' or 'name' missing

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

'p`Yh[r9x

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'r8=qbc`6q

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'rN#ekHI*

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'Symantec Class 3 SHA256 Code Signing CA

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

'Symantec Class 3 SHA256 Code Signing CA0

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

(%d least significant bits unused)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

(%d)OUT OF RANGE, oserror = %d

Ansi based on Dropped File (plc4.dll.1354026019)

('wwwwwwwwwww(

Ansi based on Memory/File Scan (certmgr.exe , 00018812-00003184.00000000.19135.00BCC000.00000002.mdmp)

(39,4):LogonType:

Ansi based on Runtime Data (schtasks.exe )

(7E<ry>XL

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

(BojD>&J'7

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

Unicode based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.009D5000.00000002.mdmp)

Unicode based on Memory/File Scan (UPEditorEdge_1.exe.bin)

(GLn$S[Q9

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

(INVALID PSS PARAMETERS)

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

(Negative)

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00160000.00000002.mdmp)

(no CKA_ID)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

(not specified)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

(o+HN(ywP

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

(orphan)

Ansi based on Hybrid Analysis (certutil.exe , 00017695-00002956.00000000.18017.013E1000.00000020.mdmp)

(Press Retry to debug the application - JIT must be enabled)

Unicode based on Dropped File (msvcr120.dll.203366350)

(unknown)

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

(V'f_/|<r

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

(wParam >= 0x20) && (wParam <= 0x7F)

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

)*&0!'muV#K

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

)d>4n~YXE

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

)J0[d?#iLU

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

)mn!7ddn=

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

)n1o8<-]Lf(

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

*"(-s92Z9

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

****** Time Invalid CTL

Unicode based on Memory/File Scan (certmgr.exe , 00018812-00003184.00000000.19135.00BCC000.00000002.mdmp)

*************************************

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

*****************************************************************************

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

*****************************************************************************%d

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

*+2v"W'u

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

*2Yr3otfG

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

*?|<>/":

Ansi based on Hybrid Analysis (UPEditorEdge_1.exe.bin)

*@rkMqT<

Ansi based on Memory/File Scan (UPService.exe , 00015446-00002584.00000000.15768.00EF8000.00000080.mdmp)

*C4MKP5cB

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

*H@[rOZ%Lw

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

*m54]4!Mt-P

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

*p[[[[[[[[[[[[[[[[

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.00161000.00000020.mdmp)

*uSzAI(=-

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+!&_P}S)#

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+!Hv\]-GNG@

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+6h]VBxJM}QL

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+[n{z83tl)G

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+lu8)XcuE

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+Mwyg{T?=

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+m|msVAt~

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+sKD3Gg0i

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+xEnn8-or

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

+{6{{I1`S

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,)Dl+M.|r

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,8M^B-mb$

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,:2/,u))9

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,>s<xVR}%

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,\,{:(1w1I

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,D-Ma:z~(

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,kyFr"L=?B

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,r`"zBSqyE4

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,ThcV9CdG

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

,wW It6n%

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

- unexpected heap error

Unicode based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

-(mPsg+U*

Ansi based on Memory/File Scan (UPEditorEdge_1.exe.bin)

-- DONE --

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

-- TRIGGER %s

Ansi based on Dropped File (sqlite3.dll.1014515390)

------------

Ansi based on Memory/File Scan (UPSecurityInput.exe , 00016014-00002328.00000001.18257.0025F000.00000002.mdmp)

-----BEGIN

Ansi based on Hybrid Analysis (UPSecurityInput.exe , 00016014-00002328.00000002.20174.00160000.00000002.mdmp)

-----BEGIN CERTIFICATE-----