Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0 |
Source: Authenticator.exe, 00000000.00000003.2343490007.0000000003754000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://code.google.com/p/chromium/issues/entry |
Source: Authenticator.exe, 00000000.00000003.2343665752.00000000036D4000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crbug.com/122474. |
Source: Authenticator.exe, 00000000.00000003.2343685593.00000000036C4000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crbug.com/415315 |
Source: Authenticator.exe, 00000000.00000003.2343685593.00000000036C4000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crbug.com/415315. |
Source: Authenticator.exe | String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0 |
Source: Authenticator.exe | String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U |
Source: Authenticator.exe | String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0 |
Source: Authenticator.exe | String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0: |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0C |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0H |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0I |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://ocsp.digicert.com0O |
Source: Authenticator.exe | String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C |
Source: Authenticator.exe | String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F |
Source: Authenticator.exe | String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U |
Source: Authenticator.exe | String found in binary or memory: http://ocsp2.globalsign.com/rootr606 |
Source: Authenticator.exe | String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A |
Source: Authenticator.exe | String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0? |
Source: Authenticator.exe | String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://www.digicert.com/CPS0 |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0 |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Pref/StateMachine |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Pref/StateMachinehttps://PrefSyncJob/com |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/RFList |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://PrefSyncJob/com.adobe.acrobat.ADotCom/Resource/Sync/Upload |
Source: Authenticator.exe | String found in binary or memory: https://auth.docker.com/ |
Source: Authenticator.exe, 00000000.00000003.2343490007.0000000003754000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://chrome.google.com/webstore/category/extensions |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://comments-stage.adobe.io |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://comments.adobe.io |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://comments.adobe.io/schemas/annots_metadata.jsonld |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://comments.adobe.io/schemas/bulk_entity_v1.json |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://comments.adobe.io/schemas/entity_v1.json |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://comments.adobe.io/schemas/user_comment_metadata_result_v1.json |
Source: Authenticator.exe, 00000000.00000003.2343685593.00000000036C4000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://crbug.com/593166 |
Source: Authenticator.exe, 00000000.00000003.2343584143.0000000003714000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://crbug.com/787427. |
Source: Authenticator.exe | String found in binary or memory: https://github.com/golang/protobuf/issues/1609): |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://lifecycleapp.operationlifecycle.shutdownlifecycle.startuptimer.starttimertimer.stoppedtimer. |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://notify-stage.adobe.io |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://notify-stage.adobe.iohttps://notify.adobe.ioEnableDesktopNotificationlocaleEXPIRED%lldSync |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://notify.adobe.io |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://reviews.adobe.io |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://reviews.adobe.iourifullpayloadlinksinvitationURIreviewURIcommentingAssetURNEurekaInvitationI |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.com |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.com( |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.com.adobe.ioassetUrnreviewUrn |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.com0cW |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comAcroCoreSyncSharedReviewLoggingEnabledAcrobat_DesktopUserhttps://comments.ad |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comEventSignalForNotiUpdaterUserMetaDataAdobe |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comKhttps://scss.adobesc.com |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comReadStatusH |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comX |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comcommandNameAdd_AnnotsDelete_AnnotsUpdate_AnnotsFetch_AnnotsEurekaReviewFetch |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comemptyAnnotations |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comhttps://scss.adobesc.comhttps://scss.adobesc.com |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.cominvalidAnnotIdListp |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comreasoncom.adobe.review.sdk |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://scss.adobesc.comsuspendcrequestupdateuoperateop:W |
Source: Authenticator.exe, 00000000.00000003.2343469069.0000000003764000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://support.google.com/chrome/answer/6098869 |
Source: Authenticator.exe, 00000000.00000003.2343469069.0000000003764000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://support.google.com/cloudprint/answer/2541843 |
Source: Authenticator.exe | String found in binary or memory: https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.cominvalid |
Source: Authenticator.exe | String found in binary or memory: https://vault.azure.netusgovtrafficmanager.netvault.usgovcloudapi.nethttps://vault.azure.cn/vault.mi |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2343407587.0000000003794000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp, Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://www.digicert.com/CPS0 |
Source: Authenticator.exe | String found in binary or memory: https://www.globalsign.com/repository/0 |
Source: Authenticator.exe, 00000000.00000003.2343469069.0000000003764000.00000004.00001000.00020000.00000000.sdmp | String found in binary or memory: https://www.google.com/cloudprint#jobs |
Source: 0.3.Authenticator.exe.57b0000.7.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2e64000.15.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2f84000.2.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2f84000.0.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2ca2000.16.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2f84000.2.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2e64000.15.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2f84000.0.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.a06e000.9.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2e76000.20.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2c84000.19.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.a06e000.9.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.340c000.1.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2c84000.19.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.9b08000.11.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.364e000.18.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2ca2000.16.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2f84000.3.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.2f84000.3.raw.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 0.3.Authenticator.exe.9726000.12.unpack, type: UNPACKEDPE | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 00000000.00000003.1896316518.0000000002F4A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2417488250.0000000002C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2476745340.0000000002F4A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2097701087.000000000A2B2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2475548142.0000000002D46000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2097701087.000000000A06E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 00000000.00000003.1937825667.00000000054C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2192977139.000000000569A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2123097354.000000000996A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2122269693.0000000009BCA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2123875583.00000000097E8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2475548142.0000000002C84000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 00000000.00000003.2125448522.00000000094A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2417488250.0000000002CA2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 00000000.00000003.2125985747.0000000009322000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1835794814.00000000033D6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1938338473.000000000533E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2344407722.00000000034CC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2122576556.0000000009AEC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2121489646.0000000009D4C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1791336027.0000000003046000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2364662594.00000000031C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2191894499.000000000599E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2124897190.0000000009626000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1937267098.0000000005638000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2345573749.0000000002E64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 00000000.00000003.2477412382.0000000002D46000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1836664535.00000000031C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2109675258.0000000009F22000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1763556310.0000000003046000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1922339153.0000000005872000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1841999418.0000000002F84000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: 00000000.00000003.1936782689.0000000005872000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2346576155.0000000002E42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2343387489.00000000037A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2476787398.0000000002F38000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2476421922.00000000034CC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2124361828.00000000096A6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2477308623.0000000002E42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2097701087.000000000A130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1763556310.000000000328A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.2098162819.0000000009FC8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1763556310.0000000003650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1763556310.00000000034CE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth |
Source: 00000000.00000003.1763556310.000000000340C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Detects Arechclient2 RAT Author: ditekSHen |
Source: Authenticator.exe, 00000000.00000003.2417488250.0000000002CA2000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1896884166.0000000002D3E000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1896370901.0000000002F10000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameHelpPane.exej% vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2417488250.0000000002D64000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameaspnet_regbrowsers.exeT vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2476787398.0000000002F2A000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2344961613.0000000003404000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2448939633.0000000003670000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1896884166.0000000002D42000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameSystemSettings.exej% vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2091238614.0000000002F68000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilename64BitMAPIBroker.exeD vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameAdobeCollabSync.exeH vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1841999418.0000000003679000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameAdobeCollabSync.exeb! vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1763556310.0000000002F83000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2122269693.0000000009BC4000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2475688677.0000000003700000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1922339153.00000000057F0000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenamebluefin.exe" vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2109675258.0000000009F14000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameAcroBroker.exe~/ vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000000.1676393637.00000000020EF000.00000002.00000001.01000000.00000003.sdmp | Binary or memory string: OriginalFilenameSaint Paint Studio.exe vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2343469069.0000000003764000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameAcroCEF.exeH vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2343469069.0000000003764000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameAcroCEF.exe< vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.1896563121.0000000002EF0000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameCRLogTransport .exe6 vs Authenticator.exe |
Source: Authenticator.exe, 00000000.00000003.2346620493.0000000002D62000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: OriginalFilenameLogTransport2.exe0 vs Authenticator.exe |
Source: Authenticator.exe | Binary or memory string: OriginalFilenameSaint Paint Studio.exe vs Authenticator.exe |
Source: 0.3.Authenticator.exe.57b0000.7.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2e64000.15.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2f84000.2.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2f84000.0.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2ca2000.16.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2f84000.2.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2e64000.15.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2f84000.0.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.a06e000.9.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2e76000.20.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2c84000.19.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.a06e000.9.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.340c000.1.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2c84000.19.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.9b08000.11.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.364e000.18.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2ca2000.16.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2f84000.3.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.2f84000.3.raw.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 0.3.Authenticator.exe.9726000.12.unpack, type: UNPACKEDPE | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 00000000.00000003.1896316518.0000000002F4A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2417488250.0000000002C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2476745340.0000000002F4A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2097701087.000000000A2B2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2475548142.0000000002D46000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2097701087.000000000A06E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 00000000.00000003.1937825667.00000000054C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2192977139.000000000569A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2123097354.000000000996A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2122269693.0000000009BCA000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2123875583.00000000097E8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2475548142.0000000002C84000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 00000000.00000003.2125448522.00000000094A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2417488250.0000000002CA2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 00000000.00000003.2125985747.0000000009322000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1835794814.00000000033D6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1938338473.000000000533E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2344407722.00000000034CC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2122576556.0000000009AEC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2121489646.0000000009D4C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1791336027.0000000003046000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2364662594.00000000031C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2191894499.000000000599E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2124897190.0000000009626000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1937267098.0000000005638000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2345573749.0000000002E64000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 00000000.00000003.2477412382.0000000002D46000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1836664535.00000000031C8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2109675258.0000000009F22000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1763556310.0000000003046000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1922339153.0000000005872000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1841999418.0000000002F84000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: 00000000.00000003.1936782689.0000000005872000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2346576155.0000000002E42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2343387489.00000000037A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2476787398.0000000002F38000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2476421922.00000000034CC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2124361828.00000000096A6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2477308623.0000000002E42000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2097701087.000000000A130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1763556310.000000000328A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.2098162819.0000000009FC8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1763556310.0000000003650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1763556310.00000000034CE000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research |
Source: 00000000.00000003.1763556310.000000000340C000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY | Matched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT branches.content_item_id FROM content_item_relations JOIN branches ON( branches.content_item_id = content_item_relations.target_content_item_id) JOIN content_items ON( content_items.creation_id = content_item_relations.target_content_item_id) WHERE( content_item_relations.src_content_item_id = :srcContentItemId AND content_item_relations.rel = :relType AND branches.app_id = :appId AND branches.branch_name = :branch1 AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id NOT IN ( SELECT branches.content_item_revision_id FROM content_item_relations JOIN branches ON( branches.content_item_id = content_item_relations.target_content_item_id) WHERE( content_item_relations.src_content_item_id = :srcContentItemId AND content_item_relations.rel = :relType AND branches.app_id = :appId AND branches.branch_name = :branch2)))); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT content_item_relations.src_content_item_id, branches.download_state, content_items.creation_id,branches.content_item_id,branches.record_created, branches.modified, content_items.asset_id, content_items.type, content_items.content_item_type, content_items.removed_from_server, content_items.pending_local_delete, content_item_revisions.cloud_etag, content_item_revisions.updated, content_item_revisions.local_etag, content_item_revisions.request_id, content_item_revisions.content_name, content_item_resources.resource_cloud_etag , content_item_resources.resource_local_etag , resource_revisions.rel_to_content_item , resource_revisions.resource_type, resource_revisions.committed, resource_content.resource_content, (select 1 from branches where branch_name = 'conflict' AND content_item_id = :id) as is_conflicted,(SELECT 1 FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id) WHERE( branches.app_id = :appId AND branches.branch_name = 'current' AND branches.content_item_id = :id AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = 'base' AND branches.content_item_id = :id))))) as is_sync_pending, (SELECT resource_content.resource_content FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_resources ON (branches.content_item_revision_id = content_item_resources.content_item_revision_id) JOIN resource_revisions ON (content_item_resources.resource_revision_id = resource_revisions.revision_id) JOIN resource_content ON (resource_revisions.hash = resource_content.resource_content_id) WHERE( branches.content_item_id = :id AND branches.branch_name = 'error' AND branches.app_id = :appId)) as error_payload FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) JOIN content_item_resources ON (branches.content_item_revision |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_relations ( src_content_item_id TEXT NOT NULL, target_content_item_id TEXT NOT NULL, rel TEXT NOT NULL, PRIMARY KEY (src_content_item_id, target_content_item_id, rel)); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE branches SET content_item_revision_id = :contentItemRevisionId, modified = :modified, download_state = :downloadState WHERE( content_item_id = :contentItemId AND branch_name = :branchName AND app_id = :appId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS resource_content ( resource_content_id TEXT PRIMARY KEY NOT NULL, resource_content TEXT NOT NULL); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO content_items( creation_id, asset_id, type, content_item_type, created, removed_from_server, pending_local_delete) VALUES( :creationId, :assetId, :type, :contentItemType, :created, :removedFromServer, :pendingLocalDelete); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO pending_requests( pending_request_id, request_type, content_item_id, context) VALUES( :pendingRequestId, :requestType, :contentItemId, :context); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests WHERE( request_type = :requestType); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT *, (SELECT resource_content.resource_content FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_resources ON (branches.content_item_revision_id = content_item_resources.content_item_revision_id) JOIN resource_revisions ON (content_item_resources.resource_revision_id = resource_revisions.revision_id) JOIN resource_content ON (resource_revisions.hash = resource_content.resource_content_id) WHERE( branches.content_item_id = creation_id_local AND branches.branch_name = 'error' AND branches.app_id = :appId)) as error_payload, (SELECT 1 from branches where branch_name = 'conflict' AND content_item_id = creation_id_local) as is_conflicted, ( SELECT 1 FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id and branches.content_item_id = creation_id_local) WHERE( branches.app_id = :appId AND branches.branch_name = 'current' AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = 'base'))))) as is_sync_pending FROM ( SELECT content_item_relations.src_content_item_id, branches.download_state, branches.record_created, branches.modified, content_items.creation_id , content_items.creation_id as creation_id_local, branches.content_item_id, content_items.asset_id, content_items.type, content_items.content_item_type, content_items.removed_from_server, content_items.pending_local_delete, content_item_revisions.cloud_etag, content_item_revisions.updated, content_item_revisions.local_etag, content_item_revisions.request_id, content_item_revisions.content_name, content_item_resources.resource_cloud_etag , content_item_resources.resource_local_etag , resource_revisions.rel_to_content_item , resource_revisions.resource_type, resource_revisions.committed, resource_content.resource_content FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) JOIN content_item_resources |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE content_item_revisions SET local_etag = :localEtag, request_id = :requestId, updated = :updated WHERE( content_item_revision_id IN ( SELECT content_item_revision_id FROM branches WHERE( content_item_id = :contentItemId AND branch_name = :branchName ANDapp_id = :appId))); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests WHERE( request_type = :requestType and content_item_id = :contentItemId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE device_mappings SET unPinned = 1 WHERE(content_item_id = :contentItemId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT OR REPLACE INTO branches( content_item_id, content_item_revision_id, branch_name, app_id, is_transient, record_created, modified, download_state) VALUES( :contentItemId, :contentItemRevisionId, :branchName, :appId, :isTransient, :recordCreated, :modified, :downloadState); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS pending_requests ( pending_request_id TEXT PRIMARY KEY NOT NULL, request_type TEXT NOT NULL, content_item_id TEXT DEFAULT NULL, context TEXT DEFAULT NULL, pending_request_created TIMESTAMP DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now', 'localtime')) NOT NULL, request_status TEXT DEFAULT "CREATED" NOT NULL, message TEXT DEFAULT NULL, status_code INTEGER DEFAULT -1 NOT NULL, device_mapping_id TEXT DEFAULT NULL, UNIQUE (content_item_id, request_type, request_status)); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE content_items SET pending_local_delete = :pendingLocalDelete WHERE( creation_id = :creationId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT content_item_revisions.cloud_etag FROM content_items JOIN branches ON (branches.content_item_id = content_items.creation_id)JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id)WHERE( content_items.asset_id = :assetId AND branches.branch_name = :branchName AND branches.app_id = :appId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT OR REPLACE INTO content_item_relations( src_content_item_id, target_content_item_id, rel) VALUES( :srcContentItemId, :targetContentItemId, :rel); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO resource_revisions( revision_id, rel_to_content_item, resource_type, media_type, locator, committed, hashType, hash, storageSize, width, height) VALUES( :revisionId, :relToContentItem, :resourceType, :mediaType, :locator_var, :committed_var, :hashType_var, :hash_var, :storageSize_var, :width_var, :height_var); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT content_items.creation_id FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) WHERE (branches.branch_name = 'current' AND branches.app_id = :appid) AND ((content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR (content_item_revisions.content_item_revision_id) NOT IN ( SELECT content_item_revisions.content_item_revision_id FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) WHERE (branches.branch_name = 'base' AND branches.app_id = :appid))) AND content_items.creation_id NOT IN ( SELECT content_item_id FROM branches WHERE( branch_name = 'error')); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS branches ( content_item_id TEXT NOT NULL, content_item_revision_id TEXT NOT NULL, branch_name TEXT NOT NULL, app_id TEXT NOT NULL, is_transient INTEGER DEFAULT 0 NOT NULL, record_created TIMESTAMP NOT NULL, modified TIMESTAMP NOT NULL, download_state TEXT DEFAULT NULL, PRIMARY KEY (content_item_id, branch_name, app_id)); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_resources ( content_item_revision_id TEXT NOT NULL, resource_revision_id TEXT NOT NULL, resource_id TEXT DEFAULT NULL, resource_cloud_etag TEXT DEFAULT NULL, resource_cloud_version_id TEXT DEFAULT NULL, resource_local_etag TEXT DEFAULT NULL, resource_local_version_id TEXT DEFAULT NULL, PRIMARY KEY (content_item_revision_id, resource_revision_id)); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT creation_id FROM content_items WHERE asset_id = :assetId; |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO device_mappings( device_mapping_id, content_item_id, collection_id, content_item_type, include_rel_types, include_depth, branch, TTL, Priority, app_info) VALUES( :deviceMappingId, :contentItemId, :collectionId, :contentItemType, :includeRelTypes, :includeDepth, :branch, :TTL, :priority, :appInfo); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO content_item_resources( content_item_revision_id, resource_revision_id) VALUES( :contentItemRevisionId, :resourceRevisionId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO branches ( content_item_id, content_item_revision_id, branch_name, app_id, is_transient, record_created, modified, download_state) VALUES( :contentItemId, :contentItemRevisionId, :branchName, :appId, :isTransient, :recordCreated, :modified, :downloadState); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT * FROM device_mappings WHERE( unPinned = 1); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE content_items SET removed_from_server = :removedFromServer WHERE( creation_id = :creationId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT content_item_relations.src_content_item_id, branches.download_state, content_items.creation_id,branches.content_item_id,branches.record_created, branches.modified, content_items.asset_id, content_items.type, content_items.content_item_type, content_items.removed_from_server, content_items.pending_local_delete, content_item_revisions.cloud_etag, content_item_revisions.updated, content_item_revisions.local_etag, content_item_revisions.request_id, content_item_revisions.content_name, content_item_resources.resource_cloud_etag , content_item_resources.resource_local_etag , resource_revisions.rel_to_content_item , resource_revisions.resource_type, resource_revisions.committed, resource_content.resource_content, (select 1 from branches where branch_name = 'conflict' AND content_item_id = :id) as is_conflicted, (SELECT 1 FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id) WHERE( branches.app_id = :appId AND branches.branch_name = 'current' AND branches.content_item_id = :id AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = 'base' AND branches.content_item_id = :id))))) as is_sync_pending, (SELECT content_item_revisions.cloud_etag FROM content_items JOIN branches ON (branches.content_item_id = content_items.creation_id)JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id)WHERE( content_items.asset_id = :collectionId AND branches.branch_name = :branchName AND branches.app_id = :appId)) as collection_cloud_etag FROM branches JOIN content_items ON (branches.content_item_id = content_items.creation_id) JOIN content_item_revisions ON (branches.content_item_revision_id = content_item_revisions.content_item_revision_id) JOIN content_item_resources ON (branches.content_item_revision_id = content_item_resources.content_item_revision_id) JOIN resource_revisions ON (content_item_resources.resource_revision_id = resource_revisions.revision_id) JOIN content_item_rel |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE branches SET modified = :modified WHERE( content_item_id = :contentItemId AND branch_name = :branchName AND app_id = :appId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT branches.content_item_id FROM branches JOIN content_items ON(content_items.creation_id = branches.content_item_id) WHERE( branches.app_id = :appId AND branches.branch_name = :branch1 AND branches.content_item_id = :contentItemId AND (( content_items.pending_local_delete = 1 AND content_items.removed_from_server = 0) OR branches.content_item_revision_id not in( SELECT branches.content_item_revision_id FROM branches WHERE( branches.app_id = :appId AND branches.branch_name = :branch2 AND branches.content_item_id = :contentItemId)))); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT * FROM device_mappings WHERE( content_item_type = :resourceType); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_updates ( seq_num INTEGER PRIMARY KEY NOT NULL, app_id TEXT NOT NULL, content_item_local_id TEXT NOT NULL, time TIMESTAMP NOT NULL, operation TEXT NOT NULL); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE content_items SET asset_id = :assetId WHERE( creation_id = :creationId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS resource_revisions ( revision_id TEXT PRIMARY KEY NOT NULL, rel_to_content_item TEXT NOT NULL, resource_type TEXT NOT NULL, media_type TEXT NOT NULL, locator TEXT NOT NULL, committed INTEGER NOT NULL, hashType TEXT DEFAULT NULL, hash TEXT DEFAULT NULL, storageSize INTEGER DEFAULT 0, width INTEGER DEFAULT 0, height INTEGER DEFAULT 0); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: select count(*) from SQLITE_MASTER where type = "table"; |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE content_items SET pending_local_delete = :pendingLocalDelete WHERE( creation_id = :creationId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO content_item_revisions( content_item_revision_id, cloud_etag, updated, local_etag, request_id, content_name) VALUES( :contentIemRevisionId, :cloudEtag, :updated, :localEtag, :requestId, :contentName); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS content_item_revisions( content_item_revision_id TEXT PRIMARY KEY NOT NULL, cloud_etag TEXT DEFAULT NULL, cloud_version_id TEXT DEFAULT NULL, updated TIMESTAMP DEFAULT NULL, acl TEXT DEFAULT NULL, local_etag TEXT DEFAULT NULL, local_version_id TEXT DEFAULT NULL, request_id TEXT DEFAULT NULL, content_name TEXT DEFAULT NULL); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS content_items( creation_id TEXT PRIMARY KEY NOT NULL, asset_id TEXT DEFAULT NULL, type TEXT NOT NULL, content_item_type TEXT NOT NULL, created TEXT NOT NULL, removed_from_server INTEGER DEFAULT 0 NOT NULL, pending_local_delete INTEGER DEFAULT 0 NOT NULL, update_seq_num INTEGER DEFAULT 0 NOT NULL); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS sync_tokens ( content_item_id TEXT PRIMARY KEY NOT NULL, token TEXT DEFAULT NULL, last_sync_time TIMESTAMP DEFAULT NULL, device_mapping_id TEXT DEFAULT NULL); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: CREATE TABLE IF NOT EXISTS device_mappings ( device_mapping_id TEXT PRIMARY KEY NOT NULL, content_item_id TEXT NOT NULL, content_item_type TEXT NOT NULL, include_rel_types TEXT DEFAULT NULL, include_depth INTEGER DEFAULT 0 NOT NULL, branch TEXT DEFAULT NULL, device_mapping_created TIMESTAMP DEFAULT (strftime('%s', 'now')) NOT NULL, collection_id TEXT DEFAULT NULL, TTL INTEGER DEFAULT 0 NOT NULL, Priority INTEGER DEFAULT 0 NOT NULL, app_info TEXT NOT NULL, unPinned INTEGER DEFAULT 0 NOT NULL, UNIQUE (content_item_id, branch)); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT pending_request_id, request_type, content_item_id, context, pending_request_created, request_status, message, status_code, device_mapping_id FROM pending_requests; |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: UPDATE pending_requests SET request_status = :requestStatus, message = :message, status_code = :statusCode WHERE( pending_request_id = :pendingRequestId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT INTO resource_content( resource_content_id, resource_content) VALUES ( :resourceContentId, :resourceContent); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT *FROM pending_requests WHERE(content_item_id = :contentItemId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: SELECT * FROM device_mappings WHERE( content_item_id = :contentItemId); |
Source: Authenticator.exe, 00000000.00000003.1841999418.00000000031F7000.00000004.00001000.00020000.00000000.sdmp | Binary or memory string: INSERT OR REPLACE INTO branches ( content_item_id, content_item_revision_id, app_id, is_transient, record_created, modified, download_state, branch_name) SELECT content_item_id, content_item_revision_id, app_id, is_transient, record_created, modified, download_state, :targetBranchname from branches WHERE branch_name = :srcBranchname AND content_item_id = :contentItemId AND app_id = :appId; |