24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 9e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 041a0aeb76e6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 041a0aeb76e6…. Malware family: Trojan.Generic. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51"],"about":{"@type":"SoftwareApplication","name":"MSOCF.dll","applicationCategory":["pedll","executable"],"identifier":"041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T2003,Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFile2"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin")26:T7df,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007344.00000000.251961.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp")27:T1904,Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; File: "MSOCF.dll") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "MSOCF.dll") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "MSOCF.dll") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")28:T4c4,Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")29:T436,Found string "DeleteService" (Source: "00000000-00002340-00000C2C-2952895693") Found string "DeleteService" (Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "DeleteService" (Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "DeleteService" (Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "DeleteService" (Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "DeleteService" (Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "DeleteService" (Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")2a:T506,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")2b:T4d0,Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")2c:T753,Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; File: "MSOCF.dll") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; File: "MSOCF.dll") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "MSOCF.dll") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "MSOCF.dll") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; File: "MSOCF.dll") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007344.00000000.251961.01239000.00000002.mdmp")2d:Tda3,Found reference to API "RegSetKeySecurity" (Indicator: "RegSetKeySecurity"; File: "MSOCF.dll") Found reference to API "RegSetKeyValueW" (Indicator: "RegSetKeyValue"; File: "MSOCF.dll") Found reference to API "ZwSetValueKey" (Indicator: "ZwSetValueKey"; File: "MSOCF.dll") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00007344.00000000.251961.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp")2e:T5a1,Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "MSOCF.dll") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "MSOCF.dll") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")2f:T50d,Found reference to API "OpenServiceW" (Indicator: "OpenService"; File: "MSOCF.dll") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")30:T4cc,Found reference to API "RpcBindingFromStringBindingW" (Indicator: "RpcBindingFromStringBinding"; File: "MSOCF.dll") Found reference to API "RpcStringFreeW" (Indicator: "RpcStringFree"; File: "MSOCF.dll") Found reference to API "RpcStringBindingComposeW" (Indicator: "RpcStringBindingCompose"; File: "MSOCF.dll") Found reference to API "RpcBindingFree" (Indicator: "RpcBindingFree"; File: "MSOCF.dll") Found reference to API "RpcServerListen" (Indicator: "RpcServerListen"; File: "MSOCF.dll") Found reference to API "NdrClientCall2" (Indicator: "NdrClientCall2"; File: "MSOCF.dll") Found reference to API "NdrClientCall2" (Indicator: "NdrClientCall"; File: "MSOCF.dll") Found reference to API "NdrServerCall2" (Indicator: "NdrServerCall2"; File: "MSOCF.dll") Found reference to API "NdrServerCall2" (Indicator: "NdrServerCall"; File: "MSOCF.dll") Found reference to API "NdrClientCall4" (Indicator: "NdrClientCall"; File: "MSOCF.dll") Found reference to API "RpcServerRegisterIf2" (Indicator: "RpcServerRegisterIf"; File: "MSOCF.dll") Found reference to API "RpcServerUseProtseqEpW" (Indicator: "RpcServerUse"; File: "MSOCF.dll") Found reference to API "RpcStringFreeA" (Indicator: "RpcStringFree"; File: "MSOCF.dll")31:T8fa,Found PE header "MZ" - Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002060.00000001.253574.01200000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002340.00000001.253569.00EC0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004292.00000000.253911.04980000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004292.00000000.253911.04F40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004468.00000000.253908.047F0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004468.00000000.253908.04D80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007344.00000000.251961.01170000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007344.00000001.253579.01170000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007344.00000001.253579.04EB0000.00000040.mdmp")32:T810,Found string - \\.\DISPLAY1; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY1 1280*800; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")33:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00002340-00000C15-2927403857 [PID: 2340] "rundll32.exe" queried SystemProcessInformation at 00000000-00002340-00000C15-2927413399 [PID: 2340] "rundll32.exe" queried SystemProcessInformation at 00000000-00002340-00000C15-2927799702 [PID: 2340] "rundll32.exe" queried SystemProcessInformation at 00000000-00002340-00000C15-2927807738 [PID: 2340] "rundll32.exe" queried SystemProcessInformation at 00000000-00002340-00000C15-2954386014 [PID: 2340] "rundll32.exe" queried SystemProcessInformation at 00000000-00002340-00000C15-2954395237 [PID: 2340] "rundll32.exe" queried SystemProcessInformation at 00000000-00007524-00000C15-2927448876 [PID: 7524] "rundll32.exe" queried SystemProcessInformation at 00000000-00007524-00000C15-2927494248 [PID: 7524] "rundll32.exe" queried SystemProcessInformation at 00000000-00007524-00000C15-2928119839 [PID: 7524] "rundll32.exe" queried SystemProcessInformation at 00000000-00007524-00000C15-2928130478 [PID: 7524] "rundll32.exe" queried SystemProcessInformation at 00000000-00007524-00000C15-2954422759 [PID: 7524] "rundll32.exe" queried SystemProcessInformation at 00000000-00007524-00000C15-2954444278 [PID: 7524] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2927464050 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2927472985 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2927620771 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2927629308 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2927826774 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2927834719 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2954389701 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-2954398733 [PID: 7344] "rundll32.exe" queried SystemProcessInformation at 00000000-00002060-00000C15-2927501511 [PID: 2060] "rundll32.exe" queried SystemProcessInformation at 00000000-00002060-00000C15-2927510534 [PID: 2060] "rundll32.exe" queried SystemProcessInformation at 00000000-00002060-00000C15-2928151148 [PID: 2060] "rundll32.exe" queried SystemProcessInformation at 00000000-00002060-00000C15-2928167027 [PID: 2060] "rundll32.exe" queried SystemProcessInformation at 00000000-00002060-00000C15-2955091723 [PID: 2060]34:Ta1f,Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; File: "MSOCF.dll") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "MSOCF.dll") Found api reference "CryptAcquireCertificatePrivateKey" (Indicator: "CryptAcquireCertificatePrivateKey"; File: "MSOCF.dll") Found api reference "CryptEncodeObject" (Indicator: "CryptEncodeObject"; File: "MSOCF.dll") Found api reference "CryptExportPublicKeyInfo" (Indicator: "CryptExportPublicKeyInfo"; File: "MSOCF.dll") Found api reference "CryptSignAndEncodeCertificate" (Indicator: "CryptSignAndEncodeCertificate"; File: "MSOCF.dll") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; File: "MSOCF.dll") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "MSOCF.dll") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "MSOCF.dll") Found api reference "CertSetCertificateContextProperty" (Indicator: "CertSetCertificateContextProperty"; File: "MSOCF.dll") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "MSOCF.dll") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "MSOCF.dll") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "MSOCF.dll") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "MSOCF.dll") Found api reference "CryptHashCertificate" (Indicator: "CryptHashCertificate"; File: "MSOCF.dll") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "MSOCF.dll") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "MSOCF.dll") Found api reference "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "MSOCF.dll") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "MSOCF.dll") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "MSOCF.dll") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "MSOCF.dll") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "MSOCF.dll") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "MSOCF.dll") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "MSOCF.dll") Found api reference "NCryptDeleteKey" (Indicator: "NCryptDeleteKey"; File: "MSOCF.dll")35:Te30,file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "AppLockerCSP.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "AppxAllUserStore.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "AppxSip.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "aadauthhelper.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "appidapi.dll") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002340-00000C2C-2953054413") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002340-00000C2C-2953054469") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")36:T75c,Found reference to API "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "MSOCF.dll") Found reference to API "CryptEncodeObject" (Indicator: "CryptEncodeObject"; File: "MSOCF.dll") Found reference to API "CryptExportPublicKeyInfo" (Indicator: "CryptExportPublicKeyInfo"; File: "MSOCF.dll") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "MSOCF.dll") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "MSOCF.dll") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "MSOCF.dll") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "MSOCF.dll") Found reference to API "CryptHashCertificate" (Indicator: "CryptHashCertificate"; File: "MSOCF.dll") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; File: "MSOCF.dll") Found reference to API "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "MSOCF.dll") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "MSOCF.dll") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "MSOCF.dll") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "MSOCF.dll") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "MSOCF.dll") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "MSOCF.dll") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "MSOCF.dll") Found reference to API "NCryptFreeObject" (Indicator: "NCryptFreeObject"; File: "MSOCF.dll") Found reference to API "NCryptSetProperty" (Indicator: "NCryptSetProperty"; File: "MSOCF.dll") Found reference to API "NCryptSignHash" (Indicator: "CryptSignHash"; File: "MSOCF.dll")37:T4a3,Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004528.00000000.253897.00C40000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007344.00000000.251961.00870000.00000004.mdmp, 00000000-00007344.00000001.253579.00870000.00000004.mdmp")38:T4de,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Imports crypto-related APIs Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm39:T13a6f,Found XOR loop in file "aclui.dll" at offset 425847; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 505105; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 509737; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 560841; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 560845; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 562129; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 563413; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 564697; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 568549; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 569833; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 571117; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 572401; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 573681; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 615077; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 633557; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3023001; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3023545; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3239281; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3239881; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246313; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246317; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246481; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246645; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246809; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247301; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247465; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247629; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247793; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247953; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3253125; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3255477; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 53670; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 98538; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 257761; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3186719; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3206992; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3229988; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3229996; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 111108; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 418375; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 527178; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 565586; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 705770; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 710114; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 1311798; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 2909063; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 3849066; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 3871498; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 3947350; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1045929; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1276173; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1289113; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1291612; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1385011; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1506571; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1701331; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1712264; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1881517; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 2040999; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 2182945; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 2228277; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 3938407; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 3951347; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 3953846; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4005453; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4127013; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4321520; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4332453; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4501706; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4660939; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4802885; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4848217; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1146837; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 1151615; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 1763189; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 1879283; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2136043; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2163121; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2171320; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2211305; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2258929; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2259973; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3475840; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3491480; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3809071; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3813849; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4383378; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4499472; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4755983; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4783061; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4791260; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4831245; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4878869; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4879913; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 313063; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 320223; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 336623; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 336831; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 416856; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1080039; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1129197; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1139263; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1160522; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1497234; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1521391; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1542352; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1543081; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1554284; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1595779; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1596799; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1598327; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1599347; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1648459; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1650367; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1760910; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1816138; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1818576; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1835168; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1835577; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1840597; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1843347; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2079377; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2152341; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2177575; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2597794; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 3791431; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 3801497; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 3822756; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4117676; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4141833; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4162794; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4163523; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4174726; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4216221; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4217241; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4218769; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4219789; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4268901; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4270809; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4381099; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4436327; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4438765; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4455357; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4455766; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4460786; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4463536; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4699317; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4772281; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4797515; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 210256; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 318155; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 1296674; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 1714386; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 1835254; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 2147516; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 2569260; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3180141; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3212048; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3429128; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3667309; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3793997; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3795461; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3803445; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 67945; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 67969; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68033; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68167; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68481; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68545; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96307; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96331; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96395; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96529; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96843; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96907; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 159590; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 258357; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1047425; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1087209; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1132142; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1294911; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1500387; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1813334; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 2569007; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3426219; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3442488; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3676702; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3795255; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 187019; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 187663; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 189711; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 267109; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 287942; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 289662; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 290349; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 304341; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 819160; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 854620; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1046180; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1064831; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1287614; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1287761; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1295701; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1728921; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1938454; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1940711; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2115417; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2274177; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2347320; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2382780; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2585293; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3180228; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3211499; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3213199; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3223522; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3243624; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3435100; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3659920; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3793958; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3803434; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3803690; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2344425; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2351799; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2365165; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2369527; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2389285; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2392401; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 195894; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2355457; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2356351; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2368001; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2379863; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 6321; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 25620; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 232491; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 276087; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 277516; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 280979; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 352024; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 400886; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 519101; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 644962; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 709331; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 709587; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 709859; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 710115; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2331744; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2332666; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2344422; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2353466; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2358882; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2361182; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2364496; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2383764; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2390418; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2392382; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 16248; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 59523; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1769539; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1779053; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1782825; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1783853; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1784417; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1785529; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1933423; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1935479; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1937535; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1939591; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1941631; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1943687; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1945615; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1947671; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1948973; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1950553; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1951497; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1963103; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1965665; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1969159; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1981583; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2001687; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2003541; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2015651; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2016245; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2016843; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2019775; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2021071; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2021589; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2022751; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2024587; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2026379; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2032441; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2037225; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2037809; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1140242; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1140573; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1382822; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1951943; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1987371; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1992505; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1998463; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 39823; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 389080; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1466951; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1714419; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1724959; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1928247; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1933384; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1935440; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1937496; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1939552; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1941592; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1943648; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1945576; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1947632; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1949532; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1950534; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1951458; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1962454; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1972456; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1973590; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1999702; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2002214; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2011492; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2012116; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2014412; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2016238; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2025792; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2027468; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2031732; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2033032; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2035026; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2036128; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2038288; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2038878; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2048388; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 1661471; code bytes = 30d0 Found XOR loop in file "batmeter.dll" at offset 6918; code bytes = 33c1 Found XOR loop in file "batmeter.dll" at offset 29715; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 117253; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 121221; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 1663280; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 934371; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1473647; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1475703; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1477317; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1479211; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1502801; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1504297; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1504565; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1520729; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1537479; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1546003; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 245478; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 356201; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 694873; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 694886; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 939691; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 939840; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1109842; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1177716; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426027; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426046; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426065; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426084; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426103; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426122; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426141; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426163; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426195; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1484347; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1492585; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1494557; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1505613; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1525849; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1528371; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1341505; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1432851; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1435507; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1473608; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1475664; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1477308; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1479172; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1482504; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1487960; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1495030; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1496162; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1502598; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1506592; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1507254; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1512454; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1522338; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1524966; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1528552; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1530564; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1546202; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1405021; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1406083; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1407759; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1409815; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1411871; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1413773; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1415607; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1417663; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1419719; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1420731; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1426293; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1429837; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1436695; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1447251; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1451481; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1459231; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1474315; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1477579; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1479557; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1479727; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1480253; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 735645; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 814544; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1026180; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1120326; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1120459; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1432653; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1441665; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1447681; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 10564; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 22444; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 22620; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 98519; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 99054; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 280876; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 293226; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 599548; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 902908; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1404992; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1406064; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1407720; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1409776; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1411832; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1415568; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1417624; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1419680; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1422320; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1427202; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1429818; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1431568; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1437844; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1444516; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1450296; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1455736; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1456672; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1465960; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1466436; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1471956; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1476446; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1477574; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1479442; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1483528; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1490308; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 212735; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1239151; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1242451; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1243987; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1250665; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1255071; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1258609; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1258997; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1263479; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1266481; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1270897; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1272907; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 282038; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282057; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282076; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282095; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282114; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282133; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282152; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282174; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282206; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 313156; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 315139; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 315724; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 336780; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665261; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665369; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665384; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665469; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665484; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665500; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665590; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665605; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 1266531; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 1268635; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 114503; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 697363; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1239112; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1242412; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1243948; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1259184; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1272868; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1273086; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1216311; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1218363; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1222319; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1225425; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1230231; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1251721; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1253159; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1258729; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1260851; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1263283; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1264881; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1267375; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1268713; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1271927; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 427762; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 857190; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 899967; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1225467; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1226257; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1234951; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1241971; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1254805; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1257839; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1188876; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1216272; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1218324; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1229530; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1234582; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1241122; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1245162; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1245916; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1246856; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1253120; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1259816; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1263742; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1264256; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1265386; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1266298; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1266824; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1267364; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1269334; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1270008; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1270676; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1273224; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1275884; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1276424; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 184585; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 184895; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 188635; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 192387; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 192511; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 196107; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 196271; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 199895; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 200003; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 203575; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 203719; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 203739; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 207331; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 211067; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 211175; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 212924; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 214839; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 214911; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 214991; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 436664; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1179247; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1181167; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1183215; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1184805; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1199363; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1200783; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1211641; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1214147; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1224799; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1225167; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1237944; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 323984; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 324044; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 407323; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 440194; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1192329; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1194249; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1205383; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1207631; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1209279; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1221155; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1221571; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 150712; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 158332; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 165792; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 169182; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 170710; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 174422; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 177864; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 181842; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 183504; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 184322; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 184584; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 186528; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 187164; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 188110; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 189096; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 189254; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 191898; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 192958; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 195690; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 196658; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 199482; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 199486; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 200354; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 203252; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 203282; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 203286; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 204042; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 204046; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 205844; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207090; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207094; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207726; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207730; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 210910; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 210914; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 211394; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 211398; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 211402; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214758; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214762; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214766; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214770; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214774; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215026; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215030; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215034; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215038; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215042; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 220709; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 345961; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1085934; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1179208; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1181128; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1183184; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1188264; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1203082; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1209666; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1218818; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1225128; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1238606; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 3040; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 32544; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 279104; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 912495; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 914419; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 915781; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 918687; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 920743; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 922799; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 932887; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 939897; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 945587; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 946565; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 947815; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 950793; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 964105; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 249703; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768487; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768509; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768567; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768691; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768971; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 769029; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796046; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796068; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796126; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796250; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796530; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796588; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 926403; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 927943; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 936273; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 938159; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 944921; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 954117; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 972721; code bytes = 30040e Found XOR loop in file "AudioSes.dll" at offset 26575; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 143552; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 159169; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 230997; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 234822; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 496620; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 670588; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 745889; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 866835; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 912456; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 914380; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 915762; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 917192; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 918648; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 920704; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 922760; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 932214; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 945934; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 961028; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 961518; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 962522; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 964066; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 964476; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 974706; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 981490; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 15013; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 584676; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 907191; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 916443; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 918953; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 930747; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 932173; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 934273; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 935491; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 937667; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 939279; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 940149; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 941933; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 945061; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 945755; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 949853; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 951911; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 954345; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 76968; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 393369; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 512406; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 910887; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 918791; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 921071; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 582900; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 770996; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 771016; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 907962; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 930710; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 934236; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 935482; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 937652; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 938580; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 939264; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 940134; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 948958; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 951872; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 953756; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 252815; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 516459; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 757563; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 831779; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 833835; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 835891; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 837947; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 840003; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 844407; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 852779; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 858167; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 756486; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 842683; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 854841; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 855543; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 873499; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 880693; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 882825; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 831740; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 833796; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 835852; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 837908; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 839964; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 843256; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 862726; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 879790; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 886026; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 886124; code bytes = 8030 Found XOR loop in file "autochk.exe" at offset 3176; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 4890; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 52852; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 58874; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 852591; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 863233; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 117775; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 860263; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 861103; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 861737; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 576531; code bytes = 8030 Found XOR loop in file "autochk.exe" at offset 852552; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 833647; code bytes = 30d0 Found XOR loop in file "autoconv.exe" at offset 76705; code bytes = 33c1 Found XOR loop in file "autoconv.exe" at offset 837491; code bytes = 33c1 Found XOR loop in file "autoconv.exe" at offset 846781; code bytes = 33c1 Found XOR loop in file "autoconv.exe" at offset 557587; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 833608; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 840226; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 843462; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 844622; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 847714; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 1043; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 1047; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 807207; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 807255; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 816855; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 822615; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 812655; code bytes = 30d0 Found XOR loop in file "autofmt.exe" at offset 820465; code bytes = 30d0 Found XOR loop in file "autofmt.exe" at offset 78977; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 208454; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 815479; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 825049; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 53699; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 54231; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 54258; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 153582; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 536595; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 812616; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 814526; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 758383; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 760439; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 764027; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 773185; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 774995; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 778395; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 779969; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 780649; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 396550; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 762029; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 771453; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 778447; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 7911; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 371454; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 372412; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 751859; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 751895; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 752179; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 752215; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 758344; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 760400; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 771856; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 775338; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 778392; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 778748; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 780634; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 781084; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 514998; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 661626; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 736339; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 737823; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 739279; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 751425; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 753249; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 755275; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 71654; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 178823; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258173; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258217; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258226; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258310; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258339; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258348; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258434; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258458; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258470; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258620; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258647; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258712; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258739; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258804; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258831; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258905; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258930; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259281; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259319; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259388; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259480; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259573; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 753039; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 753581; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 3816; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 3996; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4176; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4356; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4536; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4720; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 5788; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 6024; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 6632; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 6868; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 9192; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 12954; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 44214; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 150652; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 151182; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 296631; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 297111; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 365275; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 372755; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 372887; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 375171; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 375243; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 427391; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 438899; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 439604; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 529918; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 590487; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 601995; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 602700; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 737784; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 739240; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 755236; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 38744; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 56225; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 632431; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 634459; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 636515; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 638571; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 640627; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 642683; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 644315; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 646371; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 648409; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 650459; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 652515; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 657297; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 677361; code bytes = 30d0 Found XOR loop in file "AppointmentApis.dll" at offset 181062; code bytes = 33c1 Found XOR loop in file "AppointmentApis.dll" at offset 656359; code bytes = 33c1 Found XOR loop in file "AppointmentApis.dll" at offset 664975; code bytes = 33c1 Found XOR loop in file "AppointmentApis.dll" at offset 666391; code bytes = 33c1 Found XOR loop in file "AppointmentApis.dll" at offset 668735; code bytes = 33c1 Found XOR loop in file "AppointmentApis.dll" at offset 672425; code bytes = 33c1 Found XOR loop in file "AppointmentApis.dll" at offset 674957; code bytes = 33c1 Found XOR loop in file "AppointmentApis.dll" at offset 632392; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 634420; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 636476; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 638532; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 640588; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 642644; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 644276; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 646332; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 648370; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 650420; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 652476; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 659664; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 665950; code bytes = 8030 Found XOR loop in file "AppointmentApis.dll" at offset 677052; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 486628; code bytes = 30d0 Found XOR loop in file "apphelp.dll" at offset 592741; code bytes = 30d0 Found XOR loop in file "apphelp.dll" at offset 601569; code bytes = 30d0 Found XOR loop in file "apphelp.dll" at offset 602239; code bytes = 30d0 Found XOR loop in file "apphelp.dll" at offset 613461; code bytes = 30d0 Found XOR loop in file "apphelp.dll" at offset 200091; code bytes = 33c1 Found XOR loop in file "apphelp.dll" at offset 269483; code bytes = 33c1 Found XOR loop in file "apphelp.dll" at offset 594855; code bytes = 33c1 Found XOR loop in file "apphelp.dll" at offset 601899; code bytes = 33c1 Found XOR loop in file "apphelp.dll" at offset 612451; code bytes = 33c1 Found XOR loop in file "apphelp.dll" at offset 499731; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 499735; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 591918; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 594104; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 607370; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 608708; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 609660; code bytes = 8030 Found XOR loop in file "apphelp.dll" at offset 613718; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 559215; code bytes = 30d0 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 561199; code bytes = 30d0 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 563471; code bytes = 30d0 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 566559; code bytes = 30d0 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 572739; code bytes = 30d0 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 104166; code bytes = 33c1 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 317672; code bytes = 33c1 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 569865; code bytes = 33c1 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 87148; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 87232; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 559176; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 561160; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 565490; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 566974; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 568300; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 569568; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 581378; code bytes = 8030 Found XOR loop in file "AppxApplicabilityEngine.dll" at offset 582660; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 519273; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 521161; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 523215; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 525263; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 527319; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 529355; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 531411; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 543877; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 554241; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 555267; code bytes = 30d0 Found XOR loop in file "AppContracts.dll" at offset 82637; code bytes = 33c1 Found XOR loop in file "AppContracts.dll" at offset 534687; code bytes = 33c1 Found XOR loop in file "AppContracts.dll" at offset 519234; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 521122; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 523176; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 525224; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 527280; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 529316; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 531372; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 538622; code bytes = 8030 Found XOR loop in file "AppContracts.dll" at offset 552130; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 502383; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 504407; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 506231; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 510831; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 519381; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 523095; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 529947; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 530203; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 530389; code bytes = 30d0 Found XOR loop in file "AppXDeploymentClient.dll" at offset 161135; code bytes = 33c1 Found XOR loop in file "AppXDeploymentClient.dll" at offset 514761; code bytes = 33c1 Found XOR loop in file "AppXDeploymentClient.dll" at offset 515929; code bytes = 33c1 Found XOR loop in file "AppXDeploymentClient.dll" at offset 321733; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 502344; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 504368; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 506194; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 510792; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 529698; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 530354; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 536094; code bytes = 8030 Found XOR loop in file "AppXDeploymentClient.dll" at offset 542875; code bytes = 80303a:Tac4,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "MSOCF.dll") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "MSOCF.dll") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")3b:T529,file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AUDIOKSE.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "ActionCenter.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "audiodev.dll") file/memory contains long string with (Indicator: "ZwQuerySystemInformation"; File: "aepic.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AppxAllUserStore.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AppManagementConfiguration.dll") file/memory contains long string with (Indicator: "ZwQuerySystemInformation"; File: "acppage.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "appidapi.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "BamSettingsClient.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "MSOCF.dll") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; File: "MSOCF.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007344.00000000.251961.01239000.00000002.mdmp")3c:T656,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")3d:T516,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "MSOCF.dll") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")3e:T684,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "AdmTmpl.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "authfwcfg.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "aepic.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "AppxAllUserStore.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "authz.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "AuthBroker.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "appmgmts.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "advpack.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "AtBroker.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "admwprox.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "ARP.EXE") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "MSOCF.dll") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "MSOCF.dll") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; File: "MSOCF.dll") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "MSOCF.dll") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll")3f:T1506,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "MSOCF.dll") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "MSOCF.dll") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")40:T516,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "MSOCF.dll") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")41:Tb47,file/memory contains long string with (Indicator: "postmessage"; File: "batmeter.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "AdmTmpl.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "azroleui.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "ActionCenter.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "audiodev.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "advpack.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "avifil32.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "adrclient.dll") file/memory contains long string with (Indicator: "postmessage"; File: "AuthBrokerUI.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "atl.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "avicap32.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "acppage.dll") file/memory contains long string with (Indicator: "postmessage"; File: "AuthExt.dll") file/memory contains long string with (Indicator: "postmessage"; File: "atmlib.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "Apphlpdm.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002340-00000C2C-2952714414") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "MSOCF.dll") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "MSOCF.dll") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "MSOCF.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")42:T2c6e,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002340) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002340) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007524) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007524) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007344) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007344) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002060) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002060) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000390000009e293c7758f57f0000000000380000003400000000007d0058e10b050000000000000000000000000000000000000000d0078d0040000000000000001900000000008d000000000086000000000000000000000000009072feffffff19000000000000000000000000000000d8018d0008e10b05 (UID: 00000000-00002060) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003624) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000009e293c77c8e48a000000000038000000340000000000880048dfd4040000000000000000000000000000000000000000d0073e0040000000000000000800000000003e0000000000ab120000000000000000000000009072feffffff02000000000000000000000000000000d8013e00f8ded404 (UID: 00000000-00003624) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004528) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004528) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004468) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004468) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004292) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004292)43:T568,Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: AcGenral.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: cmiv2.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: AppVEntSubsystems32.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: aadtb.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: bcastdvr.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: autochk.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: autoconv.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: autofmt.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: azroles.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: appwiz.cpl] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: AppointmentApis.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: apphelp.dll]44:T5a7,Found reference to API "GetTimeZoneInformationForYear" (Indicator: "GetTimeZoneInformation"; File: "MSOCF.dll") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")45:T1065,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "MSOCF.dll") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "MSOCF.dll") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "MSOCF.dll") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; File: "MSOCF.dll") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "MSOCF.dll") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "MSOCF.dll") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")46:T530,Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; File: "MSOCF.dll") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")47:T835,"rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA")48:Tc7e,Found registry modification API: "RegCreateKeyExW" in file "MSOCF.dll" Found registry modification API: "RegLoadMUIStringW" in file "MSOCF.dll" Found registry modification API: "RegLoadKeyW" in file "MSOCF.dll" Found registry modification API: "ZwCreateKey" in file "MSOCF.dll" Found registry modification API: "RegCreateKeyW" in "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00007344.00000000.251961.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp"49:Tb66,Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "MSOCF.dll") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; File: "MSOCF.dll") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "MSOCF.dll") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; File: "MSOCF.dll") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")4a:Tc42,file/memory contains long string(File: "azroleui.dll") file/memory contains long string(File: "adrclient.dll") file/memory contains long string(File: "acwow64.dll") file/memory contains long string(File: "at.exe") Found string "GetCommandLineA" (Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00007344.00000000.251961.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00007344.00000000.251961.01239000.00000002.mdmp, 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp")4b:T4700,"rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002340) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007524) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007344) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00002060) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00003624) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004528) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004292) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004292)4c:T645,"SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00002060-00002714-2956608246, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00002060.00000001.253574.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp, Indicator: "select displayname from antivirusproduct")4d:T506,Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")4e:T13d3,Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "MSOCF.dll") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "PsSetCreateProcessNotifyRoutineEx" (Indicator: "CreateProcess"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "PsSetCreateProcessNotifyRoutineEx" (Indicator: "CreateProcess"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "PsSetCreateProcessNotifyRoutineEx" (Indicator: "CreateProcess"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp")4f:T65a,Found reference to API "SHCreateDirectoryExW" (Indicator: "CreateDirectory"; File: "MSOCF.dll") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "MSOCF.dll") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")50:Tade,Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; File: "MSOCF.dll") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; File: "MSOCF.dll") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; File: "MSOCF.dll") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")51:T80c,Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; File: "MSOCF.dll") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00007344.00000000.251961.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp")52:Tac3,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "MSOCF.dll") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "MSOCF.dll") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "MSOCF.dll") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004528.00000000.253897.00C40000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00007344.00000000.251961.00870000.00000004.mdmp, 00000000-00007344.00000001.253579.00870000.00000004.mdmp")53:T123b,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "MSOCF.dll") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "MSOCF.dll") Found reference to API "AuthzFreeResourceManager" (Indicator: "FreeResource"; File: "MSOCF.dll") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp")54:Tb42,"MSOCF.dll" contains export function called "??0CToolbarData@MsoCF@@QAE@XZ" at ordinal 1 "MSOCF.dll" contains export function called "??0CWindow@MsoCF@@QAE@XZ" at ordinal 2 "MSOCF.dll" contains export function called "??1CToolbarData@MsoCF@@QAE@XZ" at ordinal 3 "MSOCF.dll" contains export function called "??1CWindow@MsoCF@@UAE@XZ" at ordinal 4 "MSOCF.dll" contains export function called "??1CWindowEventArgs@MsoCF@@QAE@XZ" at ordinal 5 "MSOCF.dll" contains export function called "?Allocate@Allocator@Memory@MsoCF@@YGPAXIW4FailureStrategy@23@@Z" at ordinal 6 "MSOCF.dll" contains export function called "?AppendArrayOfCharactersToWz@Strings@MsoCF@@YGXPB_WHAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z" at ordinal 7 "MSOCF.dll" contains export function called "?ClonePropertySet_Imp@IPropertySet@MsoCF@@UAGXPAPAU12@@Z" at ordinal 8 "MSOCF.dll" contains export function called "?Copy@Memory@MsoCF@@YGXPBXPAXI@Z" at ordinal 9 "MSOCF.dll" contains export function called "?CopyWzToWz@Strings@MsoCF@@YGXPB_WAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z" at ordinal 10 "MSOCF.dll" contains export function called "?Copy_MakeDeep_ComplexType@CPropertyData@MsoCF@@SGXQAXW4PropertyType@2@@Z" at ordinal 11 "MSOCF.dll" contains export function called "?Create@CWindow@MsoCF@@QAGXPB_W0KKHHIIPAUHWND__@@PAUHINSTANCE__@@@Z" at ordinal 12 "MSOCF.dll" contains export function called "?CreateActionManager@MsoCF@@YGXPAPAUIActionManager@1@@Z" at ordinal 13 "MSOCF.dll" contains export function called "?CreatePropertySet@MsoCF@@YGXPAPAUIPropertySet@1@PAU21@@Z" at ordinal 14 "MSOCF.dll" contains export function called "?CreateTheApp@Frame@MsoCF@@YGXAAUCreateTheAppArgs@12@@Z" at ordinal 15 "MSOCF.dll" contains export function called "?Destroy@CWindow@MsoCF@@QBGXXZ" at ordinal 16 "MSOCF.dll" contains export function called "?DisablePropertiesTypeSafety@MsoCF@@YGXXZ" at ordinal 17 "MSOCF.dll" contains export function called "?FGet@Properties@MsoCF@@YG_NPAUIPropertySet@2@PBUPropertyInfo@2@PAXHW4PropertyType@2@@Z" at ordinal 18 "MSOCF.dll" contains export function called "?Finish@Frame@MsoCF@@YGXXZ" at ordinal 19 "MSOCF.dll" contains export function called "?Finish@Utilities@MsoCF@@YGXXZ" at ordinal 20 "MSOCF.dll" contains export function called "?Free@Allocator@Memory@MsoCF@@YGXPAX@Z" at ordinal 21 "MSOCF.dll" contains export function called "?FreeAndZero_ComplexType@CPropertyData@MsoCF@@SGXPAXW4PropertyType@2@@Z" at ordinal 22 "MSOCF.dll" contains export function called "?Get@Properties@MsoCF@@YGXPAUIPropertySet@2@PBIPAVCPropertyValue@2@H@Z" at ordinal 23 "MSOCF.dll" contains export function called "?GetIterator_Imp@IPropertySet@MsoCF@@MAGXPAPAUIPropertySetIterator@2@@Z" at ordinal 24 "MSOCF.dll" contains export function called "?GetMsoHinst@MsoCF@@YGPAUHINSTANCE__@@XZ" at ordinal 2555:T1bf0,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00002340.00000001.253569.00640000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "Registry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00003624.00000000.253892.00880000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00007344.00000001.253579.00870000.00000004.mdmp56:T820,Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\MyUniqueApp_SingleInstance" Process rundll32.exe created mutex with name "SM0:2340:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:2340:168:WilStaging_02" Process rundll32.exe created mutex with name "Global\MyUniqueApp_SingleInstance" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2340:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2340:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7524:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7524:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:7524:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:7524:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7344:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7344:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:7344:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:7344:168:WilStaging_02" Process rundll32.exe created mutex with name "\BaseNamedObjects\MyUniqueApp_SingleInstance" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2060:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:2060:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:2060:168:WilStaging_02" Process rundll32.exe created mutex with name "eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2060:168:WilStaging_02"57:Tb32,Antivirus vendors marked dropped file "aclui.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AuthFWSnapin.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "accessibilitycpl.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AcGenral.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "cmiv2.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "batmeter.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "ActiveSyncProvider.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AppVEntSubsystems32.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "AppxPackaging.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AzureSettingSyncProvider.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AudioEng.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"), Antivirus vendors marked dropped file "AudioSes.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"), Antivirus vendors marked dropped file "aadtb.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "bcastdvr.exe" as clean (type is "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "autochk.exe" as clean (type is "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"), Antivirus vendors marked dropped file "autoconv.exe" as clean (type is "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"), Antivirus vendors marked dropped file "adtschema.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"), Antivirus vendors marked dropped file "autofmt.exe" as clean (type is "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"), Antivirus vendors marked dropped file "azroles.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "appwiz.cpl" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections")58:Tcae,"MSOCF.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "AuthFWSnapin.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "accessibilitycpl.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AcGenral.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "cmiv2.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "batmeter.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ActiveSyncProvider.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AppVEntSubsystems32.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AppxPackaging.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AzureSettingSyncProvider.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AudioEng.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AudioSes.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "aadtb.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "bcastdvr.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "autochk.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "autoconv.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "adtschema.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "autofmt.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "azroles.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "appwiz.cpl" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AppointmentApis.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "apphelp.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF59:T2c3b,"SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00002340.00000001.253569.00640000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "Registry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00003624.00000000.253892.00880000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.04F40000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004292.00000000.253911.04F40000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.04F40000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.04F40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004292.00000000.253911.04F40000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.04F40000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.04D80000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004468.00000000.253908.04D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.04D80000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.04D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004468.00000000.253908.04D80000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.04D80000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00007344.00000001.253579.00870000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00007524.00000001.253566.03390000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00007524.00000001.253566.05860000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00007524.00000001.253566.05860000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007524.00000001.253566.05860000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007524.00000001.253566.05860000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007524.00000001.253566.05860000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00007524.00000001.253566.05860000.00000040.mdmp5a:Td16,"rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72cd0000 "rundll32.exe" loaded module "NTDLL" at base 77380000 "rundll32.exe" loaded module "WS2_32.DLL" at base 76400000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73190000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 76ab0000 "rundll32.exe" loaded module "USER32.DLL" at base 75cf0000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 73dc0000 "rundll32.exe" loaded module "WINMM.DLL" at base 72bb0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72b60000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 76470000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72b40000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 72b20000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72b10000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72ac0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72ab0000 "rundll32.exe" loaded module "GDI32.DLL" at base 742b0000 "rundll32.exe" loaded module "OLE32.DLL" at base 77040000 "rundll32.exe" loaded module "OLEAUT32.DLL" at base 74030000 "rundll32.exe" loaded module "BCRYPT.DLL" at base 73260000 "rundll32.exe" loaded module "SHLWAPI.DLL" at base 74220000 "rundll32.exe" loaded module "GDIPLUS.DLL" at base 73bc0000 "rundll32.exe" loaded module "DXGI.DLL" at base 72a10000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 760c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 760c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 760c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 760c0000 "rundll32.exe" loaded module "KERNEL32" at base 76ab0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 760c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 760c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 760c0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76d60000 "rundll32.exe" loaded module "NTDLL.DLL" at base 77380000 "rundll32.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 729f0000 "rundll32.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75cd0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73990000 "rundll32.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 729f0000 "rundll32.exe" loaded module "SETUPAPI.DLL" at base 76560000 "rundll32.exe" loaded module "MSDMO.DLL" at base 729e0000 "rundll32.exe" loaded module "IMM32.DLL" at base 76dc0000 "rundll32.exe" loaded module "AVICAP32.DLL" at base 729c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 760c0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 729d0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72950000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72890000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 760c0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 760c00005b:T147b,"MSOCF.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MSOCF.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSOCF.dll" was detected as "Microsoft Linker" and name: "Linker" "AuthFWSnapin.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AuthFWSnapin.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AuthFWSnapin.dll" was detected as "Microsoft Linker" and name: "Linker" "accessibilitycpl.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "accessibilitycpl.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "accessibilitycpl.dll" was detected as "Microsoft Linker" and name: "Linker" "AcGenral.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AcGenral.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AcGenral.dll" was detected as "Microsoft Linker" and name: "Linker" "cmiv2.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cmiv2.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cmiv2.dll" was detected as "Microsoft Linker" and name: "Linker" "batmeter.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "batmeter.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "batmeter.dll" was detected as "Microsoft Linker" and name: "Linker" "ActiveSyncProvider.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ActiveSyncProvider.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ActiveSyncProvider.dll" was detected as "Microsoft Linker" and name: "Linker" "AppVEntSubsystems32.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AppVEntSubsystems32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AppVEntSubsystems32.dll" was detected as "Microsoft Linker" and name: "Linker" "AppxPackaging.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AppxPackaging.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AppxPackaging.dll" was detected as "Microsoft Linker" and name: "Linker" "AzureSettingSyncProvider.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AzureSettingSyncProvider.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AzureSettingSyncProvider.dll" was detected as "Microsoft Linker" and name: "Linker" "AudioEng.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AudioEng.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AudioEng.dll" was detected as "Microsoft Linker" and name: "Linker" "AudioSes.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AudioSes.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AudioSes.dll" was detected as "Microsoft Linker" and name: "Linker" "aadtb.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "aadtb.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "aadtb.dll" was detected as "Microsoft Linker" and name: "Linker" "bcastdvr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "bcastdvr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "bcastdvr.exe" was detected as "Microsoft Linker" and name: "Linker" "autochk.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "autochk.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "autochk.exe" was detected as "Microsoft Linker" and name: "Linker" "autoconv.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "autoconv.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "autoconv.exe" was detected as "Microsoft Linker" and name: "Linker" "adtschema.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "adtschema.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "adtschema.dll" was detected as "Microsoft Linker" and name: "Linker" "autofmt.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "autofmt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "autofmt.exe" was detected as "Microsoft Linker" and name: "Linker" "azroles.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "azroles.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "azroles.dll" was detected as "Microsoft Linker" and name: "Linker" "appwiz.cpl" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "appwiz.cpl" was detected as "Microsoft Visual C/C++" and name: "Compiler" "appwiz.cpl" was detected as "Microsoft Linker" and name: "Linker" "AppointmentApis.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AppointmentApis.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AppointmentApis.dll" was detected as "Microsoft Linker" and name: "Linker" "apphelp.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "apphelp.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "apphelp.dll" was detected as "Microsoft Linker" and name: "Linker"5c:T454,"rundll32.exe" touched "System Device Enumerator" (Path: "HKCU\WOW6432NODE\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}") "rundll32.exe" touched "VFW Capture Class Manager" (Path: "HKCU\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "rundll32.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "rundll32.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "rundll32.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "rundll32.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "rundll32.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "rundll32.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")5d:T603,"AuthFWSnapin.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "accessibilitycpl.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AcGenral.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "cmiv2.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "batmeter.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ActiveSyncProvider.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AppVEntSubsystems32.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AppxPackaging.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AzureSettingSyncProvider.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AudioEng.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AudioSes.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "aadtb.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "bcastdvr.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "autochk.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "autoconv.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "adtschema.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "autofmt.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "azroles.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "appwiz.cpl" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AppointmentApis.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "apphelp.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"5e:T5a4,"MSOCF.dll" has an executable section named ".text" "AuthFWSnapin.dll" has an executable section named ".text" "accessibilitycpl.dll" has an executable section named ".text" "AcGenral.dll" has an executable section named "TEXT" "AcGenral.dll" has an executable section named ".text" "cmiv2.dll" has an executable section named ".text" "batmeter.dll" has an executable section named ".text" "ActiveSyncProvider.dll" has an executable section named ".text" "AppVEntSubsystems32.dll" has an executable section named ".text" "AppxPackaging.dll" has an executable section named ".text" "AzureSettingSyncProvider.dll" has an executable section named ".text" "AudioEng.dll" has an executable section named ".text" "AudioEng.dll" has an executable section named "RT_CODE" "AudioSes.dll" has an executable section named ".text" "AudioSes.dll" has an executable section named "RT_CODE" "aadtb.dll" has an executable section named ".text" "aadtb.dll" has an executable section named ".orpc" "bcastdvr.exe" has an executable section named ".text" "autochk.exe" has an executable section named ".text" "autoconv.exe" has an executable section named ".text" "autofmt.exe" has an executable section named ".text" "azroles.dll" has an executable section named ".text" "appwiz.cpl" has an executable section named ".text" "AppointmentApis.dll" has an executable section named ".text" "apphelp.dll" has an executable section named ".text"5f:T5b0,"MSOCF.dll" has an writable section named ".data" "accessibilitycpl.dll" has an writable section named ".data" "accessibilitycpl.dll" has an writable section named ".didat" "AcGenral.dll" has an writable section named ".data" "AcGenral.dll" has an writable section named ".didat" "cmiv2.dll" has an writable section named ".data" "batmeter.dll" has an writable section named ".data" "batmeter.dll" has an writable section named ".didat" "ActiveSyncProvider.dll" has an writable section named ".data" "ActiveSyncProvider.dll" has an writable section named ".didat" "AppVEntSubsystems32.dll" has an writable section named ".data" "AppVEntSubsystems32.dll" has an writable section named ".detourd" "AppxPackaging.dll" has an writable section named ".data" "AppxPackaging.dll" has an writable section named ".didat" "AzureSettingSyncProvider.dll" has an writable section named ".data" "AzureSettingSyncProvider.dll" has an writable section named ".didat" "AudioEng.dll" has an writable section named "RT_BSS" "AudioEng.dll" has an writable section named ".data" "AudioEng.dll" has an writable section named ".didat" "AudioEng.dll" has an writable section named "RT_DATA" "AudioSes.dll" has an writable section named "RT_BSS" "AudioSes.dll" has an writable section named ".data" "AudioSes.dll" has an writable section named ".didat" "AudioSes.dll" has an writable section named "RT_DATA" "aadtb.dll" has an writable section named ".data"60:T34bc,"MSOCF.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10006d5e,call 0x1000bc43,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10006d73,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x10019190,call 0x10007e40,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x10006d95,cmp dword ptr [0x1001cee0], esi,je 0x10006e79,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x10006da3,cmp esi, 2,jne 0x10006dd8,mov ecx, dword ptr [0x10015494],test ecx, ecx,je 0x10006db9,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "AuthFWSnapin.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add dword ptr [eax], eax,add byte ptr [eax], al,add al, byte ptr [eax],add byte ptr [eax], al,add eax, dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add eax, dword ptr [eax],add byte ptr [eax], al,add dword ptr [eax], eax,add byte ptr [eax], al,add al, byte ptr [eax],add byte ptr [eax], al,add eax, 0x6000000,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al,pop es,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al,add al, byte ptr [eax],add byte ptr [eax], al,add dword ptr [eax], eax,add byte ptr [eax], al,add eax, dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax - 0x70f1f40], al,cld ," "accessibilitycpl.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10027470,call 0x10027b03,pop ebp,jmp 0x10027496,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x10027492,push dword ptr [ebp + 0xc],push eax,call 0x100279ab,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x10029680,call 0x10027bac,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x100274bb,mov dword ptr [0x1002a3f0], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x100274d2," "AcGenral.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x79030b40,call 0x790316d3,pop ebp,jmp 0x79030b66,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x79030b62,push dword ptr [ebp + 0xc],push eax,call 0x7903157c,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x7909fa20,call 0x7903177c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x79030b8b,mov dword ptr [0x790a8f74], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x79030ba2," "cmiv2.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10151780,call 0x10152543,pop ebp,jmp 0x101517a6,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x101517a2,push dword ptr [ebp + 0xc],push eax,call 0x101523eb,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x101a16e0,call 0x101525ec,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x101517cb,mov dword ptr [0x101a3e9c], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x101517e2," "batmeter.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x5e501ec0,call 0x5e5026a3,pop ebp,jmp 0x5e501ee6,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x5e501ee2,push dword ptr [ebp + 0xc],push eax,call 0x5e502549,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x5e506348,call 0x5e50274c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x5e501f0b,mov dword ptr [0x5e507014], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x5e501f22," "ActiveSyncProvider.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003c310,call 0x1003ca83,pop ebp,jmp 0x1003c336,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x1003c332,push dword ptr [ebp + 0xc],push eax,call 0x1003c92e,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x1015d268,call 0x1003cb2c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x1003c35b,mov dword ptr [0x1015f320], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x1003c372," "AppVEntSubsystems32.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100fab30,call 0x100fb48a,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100fa9d7,add esp, 0xc,pop ebp,ret 0xc,cmp ecx, dword ptr [0x10153734],bnd jne 0x100fab50,bnd ret ,bnd jmp 0x100faf48,mov edi, edi,push ebp,mov ebp, esp,jmp 0x100fab6a,push dword ptr [ebp + 8],call 0x101034db,pop ecx,test eax, eax,je 0x100fab79,push dword ptr [ebp + 8],call 0x100ff1a1,pop ecx,test eax, eax,je 0x100fab5d,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x100fb7d5," "AppxPackaging.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1004df80,call 0x1004d2f0,push dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],mov ecx, dword ptr [ebp + 8],call 0x1004a6ba,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push esi,mov esi, edx,mov edx, dword ptr [ebp + 0xc],push edi,mov edi, ecx,call 0x100615ff,push dword ptr [ebp + 0xc],mov edx, esi,mov ecx, edi,push 1,push dword ptr [ebp + 4],push 0,push 0,push dword ptr [ebp + 8],call 0x1004b59a,pop edi,pop esi,pop ebp,ret 8,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 0xc],push 1,push dword ptr [ebp + 4],push 0,push 0," "AzureSettingSyncProvider.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100d1430,call 0x100d2003,pop ebp,jmp 0x100d1456,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x100d1452,push dword ptr [ebp + 0xc],push eax,call 0x100d1eac,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x10121570,call 0x100d20ac,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x100d147b,mov dword ptr [0x10124cec], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x100d1492," "AudioEng.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1006b890,call 0x1006c388,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1006b737,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x10117364],bnd jne 0x1006b8bb,bnd ret ,bnd jmp 0x1006ba60,push 0x10,push 0x1010d090,call 0x1006c630,mov byte ptr [ebp - 0x1d], 0,mov ebx, dword ptr [ebp + 0xc],mov eax, ebx,mov edi, dword ptr [ebp + 0x10],imul eax, edi,mov esi, dword ptr [ebp + 8],add esi, eax,mov dword ptr [ebp + 8], esi," "AudioSes.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003d050,call 0x1003db6d,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003cef7,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x100d26b4],bnd jne 0x1003d07b,bnd ret ,bnd jmp 0x1003d3e7,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 0x14],push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8]," "aadtb.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1007d410,call 0x1007dd33,pop ebp,jmp 0x1007d436,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x1007d432,push dword ptr [ebp + 0xc],push eax,call 0x1007dbe0,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x100b9c10,call 0x1007d9f0,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x1007d45b,mov dword ptr [0x100be080], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x1007d472," "bcastdvr.exe" file has an entrypoint instructions - "call 0x4b96a3,jmp 0x4b8b23,jmp dword ptr [0x4c9590],cmp ecx, dword ptr [0x4c7ea4],jne 0x4b8cfb,ret 0,jmp 0x4b8d30,jmp dword ptr [0x4c95b0],mov edi, edi,push ebp,mov ebp, esp,push 0,call dword ptr [0x4c9208],push dword ptr [ebp + 8],call dword ptr [0x4c9210],push 0xc0000409,call dword ptr [0x4c92ac],push eax,call dword ptr [0x4c92a4],pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x324,mov dword ptr [0x4c8078], eax," "autochk.exe" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,call 0x488b85,mov ecx, dword ptr [ebp + 8],call 0x4087a0,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ebx,push esi,xor esi, esi,mov ebx, ecx,test edx, edx,je 0x408a7a,cmp edx, 0x7fffffff,jbe 0x408a7f,mov esi, 0x80070057,test esi, esi,js 0x408ab4,push edi,push dword ptr [ebp + 0xc],lea edi, [edx - 1],xor esi, esi,push dword ptr [ebp + 8],push edi,push ebx,call dword ptr [0x48e08c],add esp, 0x10,test eax, eax,js 0x408aa6,cmp eax, edi,ja 0x408aa6,jne 0x408ab1,jmp 0x408aab,mov esi, 0x8007007a,xor eax, eax,mov word ptr [ebx + edi*2], ax,pop edi,jmp 0x408abd," "autoconv.exe" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,call 0x484513,mov ecx, dword ptr [ebp + 8],call 0x40650e,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ebx,push esi,xor esi, esi,mov ebx, ecx,test edx, edx,je 0x4067ea,cmp edx, 0x7fffffff,jbe 0x4067ef,mov esi, 0x80070057,test esi, esi,js 0x406824,push edi,push dword ptr [ebp + 0xc],lea edi, [edx - 1],xor esi, esi,push dword ptr [ebp + 8],push edi,push ebx,call dword ptr [0x489058],add esp, 0x10,test eax, eax,js 0x406816,cmp eax, edi,ja 0x406816,jne 0x406821,jmp 0x40681b,mov esi, 0x8007007a,xor eax, eax,mov word ptr [ebx + edi*2], ax,pop edi,jmp 0x40682d," "adtschema.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "autofmt.exe" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,call 0x47f4bf,mov ecx, dword ptr [ebp + 8],call 0x406008,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ebx,push esi,xor esi, esi,mov ebx, ecx,test edx, edx,je 0x4062ea,cmp edx, 0x7fffffff,jbe 0x4062ef,mov esi, 0x80070057,test esi, esi,js 0x406324,push edi,push dword ptr [ebp + 0xc],lea edi, [edx - 1],xor esi, esi,push dword ptr [ebp + 8],push edi,push ebx,call dword ptr [0x484048],add esp, 0x10,test eax, eax,js 0x406316,cmp eax, edi,ja 0x406316,jne 0x406321,jmp 0x40631b,mov esi, 0x8007007a,xor eax, eax,mov word ptr [ebx + edi*2], ax,pop edi,jmp 0x40632d," "azroles.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10060be0,call 0x100618a3,pop ebp,jmp 0x10060c06,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x10060c02,push dword ptr [ebp + 0xc],push eax,call 0x10061748,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x100661d0,call 0x1006194c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x10060c2b,mov dword ptr [0x10068718], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x10060c42," "appwiz.cpl" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x719118e0,call 0x71912383,pop ebp,jmp 0x71911906,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x71911902,push dword ptr [ebp + 0xc],push eax,call 0x71912228,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x71940500,call 0x7191242c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x7191192b,mov dword ptr [0x71945114], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x71911942," "AppointmentApis.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1002c410,call 0x1002cee3,pop ebp,jmp 0x1002c436,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x1002c432,push dword ptr [ebp + 0xc],push eax,call 0x1002cd87,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x10094d90,call 0x1002cf8c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x1002c45b,mov dword ptr [0x10096204], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x1002c472," "apphelp.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 0xc],push esi,xor esi, esi,sub eax, esi,je 0x78cb3771,sub eax, 1,jne 0x78cb37bc,push dword ptr [ebp + 0x10],push 1,push dword ptr [ebp + 8],call 0x78cb1a16,push ecx,mov ecx, 0x78cf8128,call 0x78cb0c19,push 0x400,mov edx, 0x78c845f0,mov ecx, 0x78cf9940,call 0x78cada82,mov ecx, dword ptr [0x78cf9940],mov dword ptr [0x78cf9928], 0x78caaf20,call 0x78cad98c,call 0x78cabd6b,mov ecx, dword ptr [ebp + 8],"61:T6b9,"MSOCF.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "accessibilitycpl.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AcGenral.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cmiv2.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "batmeter.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ActiveSyncProvider.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AppVEntSubsystems32.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AppxPackaging.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AzureSettingSyncProvider.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AudioEng.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AudioSes.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "aadtb.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "bcastdvr.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "autochk.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "autoconv.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "adtschema.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "autofmt.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "azroles.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "appwiz.cpl" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AppointmentApis.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "apphelp.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE62:T640,Found reference to API "CreateServiceW" (Indicator: "CreateService"; File: "MSOCF.dll") Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; File: "MSOCF.dll") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "36,3209,,CreateServiceA,advapi32.dll,"01:05:59.562",RX=0,PX=0" (Indicator: "CreateService"; Source: "00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")63:T3e95,"aclui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWSnapin.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "accessibilitycpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcGenral.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cmiv2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "batmeter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActiveSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppVEntSubsystems32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "AppxPackaging.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AzureSettingSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AudioEng.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AudioSes.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "aadtb.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "bcastdvr.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "autochk.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "autoconv.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "adtschema.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "autofmt.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "azroles.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "appwiz.cpl" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppointmentApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apphelp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00004528] "AppxApplicabilityEngine.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppContracts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppXDeploymentClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenterCPL.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcSpecfc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advapi32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00004528] "authui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AdmTmpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ActivationManager.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppResolver.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AUDIOKSE.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AcLayers.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00004528] "appmgr.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AccountsRt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "authfwcfg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "azroleui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atmfd.dll" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 6 sections"- [targetUID: N/A] "AuthFWGP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsnt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppIdPolicyEngineApi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "actxprxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AboveLockAppHost.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "audiodev.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppLockerCSP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "activeds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuditNativeSnapIn.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "accountaccessor.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aepic.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsldpc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "adsldp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppxAllUserStore.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "authz.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "basecsp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthBroker.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "appmgmts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "altspace.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "AppxSip.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aadauthhelper.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "autoplay.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppExtension.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppManagementConfiguration.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppointmentActivation.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advpack.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuthFWWizFwk.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "avifil32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adrclient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpolmsg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AuthBrokerUI.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "adsmsext.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcXtrnal.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppCapture.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "amstream.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "asycfilt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "msimsg.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "avicap32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00003624] "acppage.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bcastdvr.proxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ApiSetHost.AppExecutionAlias.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BackgroundMediaPolicy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "comdlg32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AuditPolicyGPInterop.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpolcore.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuthExt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AddressParser.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appidapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "amsi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adprovider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AtBroker.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "APHostClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "admwprox.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cdosys.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "windows.ui.xaml.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "azman.msc" has type "Unknown"- [targetUID: N/A] "atmlib.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acwow64.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AdaptiveCards.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atlthunk.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BackgroundTransferHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AcWinRT.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "SyncRes.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "Apphlpdm.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aeevts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "ActivationClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aspnet_counters.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpol.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "avrt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppVClientPS.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ahadmin.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aspperf.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AzSqlExt.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "at.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "appidtel.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "AnalogCommonProxyStub.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "attrib.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "backgroundTaskHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AppVTerminator.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "mlang.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "fms.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AppVSentinel.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BamSettingsClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "apprepapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acledit.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "comctl32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "quickassist.exe.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "asferror.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "advapi32res.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "activeds.tlb" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "EmbeddedDriverService.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections"- Location: [%TEMP%\EmbeddedDriverService.sys]- [targetUID: 00000000-00004528] "ARP.EXE" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "amcompat.tlb" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AppxProvisioning.xml" has type "Unknown"- [targetUID: N/A] "sys_cache.dat" has type "Unknown"- Location: [%TEMP%\sys_cache.dat]- [targetUID: 00000000-00004528] "12520850.cpx" has type "Unknown"- [targetUID: N/A] "12520437.cpx" has type "Unknown"- [targetUID: N/A] "@WirelessDisplayToast.png" has type "PNG image data 64 x 64 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "@VpnToastIcon.png" has type "PNG image data 64 x 64 4-bit colormap non-interlaced"- [targetUID: N/A] "@EnrollmentToastIcon.png" has type "PNG image data 71 x 71 8-bit gray+alpha non-interlaced"- [targetUID: N/A] "@AudioToastIcon.png" has type "PNG image data 44 x 44 8-bit gray+alpha non-interlaced"- [targetUID: N/A]64:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")65:Tb3f,"aclui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWSnapin.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "accessibilitycpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcGenral.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cmiv2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "batmeter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActiveSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppVEntSubsystems32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "AppxPackaging.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AzureSettingSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AudioEng.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AudioSes.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "aadtb.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "adtschema.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "azroles.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppointmentApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apphelp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00004528] "AppxApplicabilityEngine.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppContracts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppXDeploymentClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenterCPL.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcSpecfc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advapi32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00004528] "authui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AdmTmpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A]66:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")67:T4eb,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Calls an API typically used to find device information Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: Contains ability to detect sandbox (imports API)68:T1247,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002340-00000C2C-2927919281") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "MSOCF.dll") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "MSOCF.dll") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "MSOCF.dll") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "MSOCF.dll") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "MSOCF.dll") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")69:T4ee,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")6a:T551,Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "MSOCF.dll") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "MSOCF.dll") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "MSOCF.dll") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "MSOCF.dll") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "MSOCF.dll") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "MSOCF.dll") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "MSOCF.dll") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "MSOCF.dll") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "MSOCF.dll") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "MSOCF.dll") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "MSOCF.dll")6b:T99c,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")6c:T7ea,Pattern match: "msn.com/en-us/foodanddrink/foodnews/" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "u.qqt/qqsj0ppsssu" Pattern match: "5.xfk/nnp7" Pattern match: "vhp.yxvhp.vhp/d$hpt$,sd$`pd$tpd$th!d$" Pattern match: "mode.rich/.text`.data.idata@.didat.rsrc@.relocinitializeconditionvariablesleepconditionvariablecswakeallconditionvariabletwinapi.appcore.dllapi-ms-win-core-com-l1-1-0.dllapi-ms-win-security-sddl-l1-1-0.dlluserenv.dlloleaut32.dllapi-ms-win-core-com-l1-1-1.d" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u~d_nlik'lwashington1redmond1microsoft" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i~^;{m" Pattern match: "http://schemas.microsoft.com/appx/2013/appxprovisionpackage" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "https://www.microsoft.com/en-us/windows" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0"6d:T4c2e,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004292.00000000.253911.04F40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004292.00000000.253911.04F40000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004292.00000000.253911.04F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004292.00000000.253911.04F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004292.00000000.253911.04F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004292.00000000.253911.04F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004468.00000000.253908.04D80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004468.00000000.253908.04D80000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004468.00000000.253908.04D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004468.00000000.253908.04D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004468.00000000.253908.04D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004468.00000000.253908.04D80000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004528.00000000.253897.00C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007344.00000000.251961.00870000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007344.00000001.253579.00870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00007344.00000001.253579.04EB0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00007344.00000001.253579.04EB0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00007344.00000001.253579.04EB0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007344.00000001.253579.04EB0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007344.00000001.253579.04EB0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007344.00000001.253579.04EB0000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007524.00000000.251964.03390000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007524.00000001.253566.03390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00007524.00000001.253566.05860000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00007524.00000001.253566.05860000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00007524.00000001.253566.05860000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007524.00000001.253566.05860000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007524.00000001.253566.05860000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007524.00000001.253566.05860000.00000040.mdmp")6e:T470,YARA signature for encryption algorithm process "00000000-00004528" YARA signature for encryption algorithm file "advapi32.dll" YARA signature for encryption algorithm file "appidapi.dll" YARA signature for encryption algorithm file "AudioSes.dll" YARA signature for encryption algorithm process "00000000-00004468" YARA signature for encryption algorithm process "00000000-00004292" YARA signature for encryption algorithm file "AppXDeploymentClient.dll" YARA signature for encryption algorithm file "AzureSettingSyncProvider.dll" YARA signature for encryption algorithm process "00000000-00002340" YARA signature for encryption algorithm process "00000000-00007344" YARA signature for encryption algorithm file "AppxAllUserStore.dll" YARA signature for encryption algorithm file "AppxPackaging.dll" YARA signature for encryption algorithm file "aepic.dll" YARA signature for encryption algorithm process "00000000-00003624" YARA signature for encryption algorithm process "00000000-00007524" YARA signature for encryption algorithm process "00000000-00002060" YARA signature for encryption algorithm file "apphelp.dll"6f:T12e0,Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "MSOCF.dll") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "MSOCF.dll") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp")70:T586,Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00002340-00000C2C-2952668248") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")71:T660,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API ",,RtlGetNtProductType,NTDLL.dll,"01:05:36.01" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp 00000000-00002340.00000001.253569.00640000.00000004.mdmp"), Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp"), Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp"), Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp"), Found reference to API " RtlGetNtProductType NTDLL.dll "01:06:05.98" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")72:T830,Found registry query API: "RegGetValueW" in file "MSOCF.dll" Found registry query API: "SHGetValueW" in file "MSOCF.dll" Found registry query API: "RegQueryValueExA" in file "MSOCF.dll" Found registry query API: "NtQueryValueKey" in file "MSOCF.dll" Found registry query API: "RegSaveKeyExW" in file "MSOCF.dll" Found registry query API: "RegOpenKeyW" in file "MSOCF.dll" Found registry query API: "NtEnumerateValueKey" in file "MSOCF.dll" Found registry query API: "NtEnumerateKey" in file "MSOCF.dll" Found registry query API: "NtQueryKey" in file "MSOCF.dll" Found registry query API: "RegNotifyChangeKeyValue" in file "MSOCF.dll" Found registry query API: "ZwEnumerateKey" in file "MSOCF.dll" Found registry query API: "ZwQueryValueKey" in file "MSOCF.dll" Found registry query API: "RtlQueryRegistryValuesEx" in file "MSOCF.dll" Found registry query API: "RegEnumKeyW" in file "MSOCF.dll" Found registry query API: "RegQueryValueW" in file "MSOCF.dll" Found registry query API: "SHQueryValueExW" in file "MSOCF.dll" Found registry query API: "SHRegGetValueW" in file "MSOCF.dll" Found registry query API: "ZwQueryKey" in file "MSOCF.dll" Found registry query API: "ZwEnumerateValueKey" in file "MSOCF.dll" Found registry query API: "RegQueryValueExW" in "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp"73:Tab7,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "MSOCF.dll") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; File: "MSOCF.dll") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")74:T819,"rundll32.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00002060)75:Tb65,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileNameW" (Indicator: "FindFirstFile"; File: "MSOCF.dll") Found reference to API "FindNextFileNameW" (Indicator: "FindNextFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")76:T4f9,Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00003624.00000000.253892.00F40000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00004468.00000000.253908.047F0000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00004528.00000000.253897.04860000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00007344.00000000.251961.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.01170000.00000040.mdmp")77:T4dc,Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")78:T518,Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")79:T4be,Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")7a:T552,Found reference to API "GetSystemMetricsForDpi" (Indicator: "GetSystemMetrics"; File: "MSOCF.dll") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")7b:Tbee,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp7c:Tc67,Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[numlock]" (Indicator: "[NumLock]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[scrolllock]" (Indicator: "[ScrollLock]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[F12]" (Indicator: "[F12]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp")7d:Te7a,Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")7e:T606,Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002060-00002714-2956608246") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")7f:Td0e,Found registry deletion API: "RegDeleteTreeW" in file "MSOCF.dll" Found registry deletion API: "SHDeleteKeyW" in file "MSOCF.dll" Found registry deletion API: "RegDeleteKeyW" in file "MSOCF.dll" Found registry deletion API: "NtDeleteValueKey" in file "MSOCF.dll" Found registry deletion API: "NtDeleteKey" in file "MSOCF.dll" Found registry deletion API: "RegDeleteKeyValueW" in file "MSOCF.dll" Found registry deletion API: "RegDeleteKeyExW" in file "MSOCF.dll" Found registry deletion API: "RegDeleteValueW" in "00000000-00002060.00000000.251963.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.01200000.00000040.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002340.00000000.251962.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.00EC0000.00000040.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00003624.00000000.253892.00F40000.00000040.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004292.00000000.253911.04760000.00000040.mdmp, 00000000-00004292.00000000.253911.04980000.00000040.mdmp, 00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.047F0000.00000040.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004528.00000000.253897.04860000.00000040.mdmp, 00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00007344.00000000.251961.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.01170000.00000040.mdmp, 00000000-00007344.00000001.253579.04EB0000.00000040.mdmp"80:T547,Observed import api "OpenProcess" which can be "used to open a process handle" [Source: accessibilitycpl.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: AcGenral.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: cmiv2.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: AppVEntSubsystems32.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: aadtb.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: bcastdvr.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: autochk.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: autoconv.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: autofmt.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: azroles.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: appwiz.cpl] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: AppointmentApis.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: apphelp.dll]81:T1593,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002060.00000000.251963.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msrpc.sys" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msrpc.sys" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ksecdd.sys" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ksecdd.sys" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\werkernel.sys" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\werkernel.sys" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\CLFS.SYS" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\CLFS.SYS" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\tm.sys" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\tm.sys" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\FLTMGR.SYS" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\FLTMGR.SYS" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\clipsp.sys" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\clipsp.sys" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cmimcext.sys" (Indicator: "\drivers\"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cmimcext.sys" (Indicator: "system32\drivers"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002340.00000000.251962.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.00640000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004292.00000000.253911.00910000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp")82:T50d,Found reference to API "CoGetObjectContext" (Indicator: "CoGetObject"; File: "MSOCF.dll") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")83:T4d6,Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")84:T55c,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "MSOCF.dll") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "MSOCF.dll") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")85:Tf2e,Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")86:T1433,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll") Found reference to API "RtlCheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll") Found reference to API "ZwQueryInformationToken" (Indicator: "ZwQueryInformationToken"; File: "MSOCF.dll") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00002060.00000001.253574.007D0000.00000004.mdmp, 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00002340.00000001.253569.00640000.00000004.mdmp, 00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00003624.00000000.253892.00880000.00000004.mdmp, 00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp")87:T1676,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "MSOCF.dll") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "MSOCF.dll") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; File: "MSOCF.dll") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; File: "MSOCF.dll") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")88:T9aa,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "MSOCF.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "MSOCF.dll") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "MSOCF.dll") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "MSOCF.dll") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "MSOCF.dll") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "MSOCF.dll") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "MSOCF.dll") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "MSOCF.dll") Found reference to API "GetAce" (Indicator: "GetAce"; File: "MSOCF.dll") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "MSOCF.dll") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "MSOCF.dll") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "MSOCF.dll") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "MSOCF.dll") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "MSOCF.dll") Found reference to API "RtlInitializeSid" (Indicator: "InitializeSid"; File: "MSOCF.dll") Found reference to API "RtlEqualSid" (Indicator: "EqualSid"; File: "MSOCF.dll") Found reference to API "SetSecurityDescriptorControl" (Indicator: "SetSecurityDescriptorControl"; File: "MSOCF.dll") Found reference to API "CopySid" (Indicator: "CopySid"; File: "MSOCF.dll") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "MSOCF.dll") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "MSOCF.dll") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "MSOCF.dll") Found reference to API "AddAce" (Indicator: "AddAce"; File: "MSOCF.dll") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "MSOCF.dll") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "MSOCF.dll") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "MSOCF.dll") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "MSOCF.dll")89:T413f,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: accessibilitycpl.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: accessibilitycpl.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: accessibilitycpl.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: accessibilitycpl.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: AcGenral.dll] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: AcGenral.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: AcGenral.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: AcGenral.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: AcGenral.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: AcGenral.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AcGenral.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: AcGenral.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: AcGenral.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: AcGenral.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: AcGenral.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: AcGenral.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: AcGenral.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: cmiv2.dll] Observed import api "SetSecurityDescriptorControl" which can "set the control bits of a security descriptor" [Source: cmiv2.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: AppVEntSubsystems32.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: AppVEntSubsystems32.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: AppVEntSubsystems32.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: AppVEntSubsystems32.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: AppVEntSubsystems32.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: AppVEntSubsystems32.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: AppVEntSubsystems32.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: AppVEntSubsystems32.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: AppVEntSubsystems32.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: AppVEntSubsystems32.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: AppVEntSubsystems32.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: AppVEntSubsystems32.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: AppVEntSubsystems32.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: AppVEntSubsystems32.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: AppVEntSubsystems32.dll] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: AppVEntSubsystems32.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: AppxPackaging.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: AppxPackaging.dll] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: AppxPackaging.dll] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: AppxPackaging.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: AppxPackaging.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: AppxPackaging.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AppxPackaging.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: AppxPackaging.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: aadtb.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: aadtb.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: aadtb.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: aadtb.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: aadtb.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: bcastdvr.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: bcastdvr.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: autochk.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: autochk.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: autochk.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: autochk.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: autoconv.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: autoconv.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: autoconv.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: autoconv.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: autofmt.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: autofmt.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: autofmt.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: autofmt.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: azroles.dll] Observed import api "AddAccessAllowedAceEx" which can "add an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: azroles.dll] Observed import api "AddAccessAllowedObjectAce" which can "add an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: azroles.dll] Observed import api "AddAuditAccessAce" which can "add a system-audit access control entry (ACE) to a system access control list (ACL)" [Source: azroles.dll] Observed import api "AddAuditAccessAceEx" which can "add a system-audit access control entry (ACE) to the end of a system access control list (SACL)" [Source: azroles.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: azroles.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: azroles.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: azroles.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: azroles.dll] Observed import api "EqualDomainSid" which can "determine whether two SIDs are from the same domain" [Source: azroles.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: azroles.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: azroles.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: azroles.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: azroles.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: azroles.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: azroles.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: azroles.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: azroles.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: azroles.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: azroles.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: azroles.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: azroles.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: azroles.dll] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: azroles.dll] Observed import api "AccessCheck" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: azroles.dll] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: azroles.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: azroles.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: apphelp.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: apphelp.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: apphelp.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: apphelp.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: apphelp.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: apphelp.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: apphelp.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: apphelp.dll]8a:T9ba,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")8b:T51a,Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; File: "MSOCF.dll") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp")8c:T6c5,Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "MSOCF.dll") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; File: "MSOCF.dll") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "MSOCF.dll") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002060.00000001.253574.04FD0000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002340.00000001.253569.04B10000.00000004.mdmp, 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00003624.00000000.253892.04B60000.00000004.mdmp, 00000000-00003624.00000000.253892.04C60000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004292.00000000.253911.04B90000.00000040.mdmp, 00000000-00004292.00000000.253911.04F40000.00000004.mdmp, 00000000-00004292.00000000.253911.050C0000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004468.00000000.253908.00860000.00000004.mdmp, 00000000-00004468.00000000.253908.04D80000.00000004.mdmp, 00000000-00004468.00000000.253908.04F60000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004528.00000000.253897.04E90000.00000004.mdmp, 00000000-00004528.00000000.253897.04F90000.00000040.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00007344.00000000.251961.01239000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00007344.00000000.251961.01239000.00000002.mdmp")8d:T599,"MSOCF.dll" was detected as "Borland Delphi 3.0 (???)" "accessibilitycpl.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AcGenral.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "cmiv2.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "batmeter.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "ActiveSyncProvider.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AppVEntSubsystems32.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AppxPackaging.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AzureSettingSyncProvider.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AudioEng.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AudioSes.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "aadtb.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "bcastdvr.exe" was detected as "VC8 -> Microsoft Corporation" "autochk.exe" was detected as "Visual C++ 2003 DLL -> Microsoft" "autoconv.exe" was detected as "Visual C++ 2003 DLL -> Microsoft" "adtschema.dll" was detected as "Microsoft Visual C++ vx.x DLL" "autofmt.exe" was detected as "Visual C++ 2003 DLL -> Microsoft" "azroles.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "appwiz.cpl" was detected as "Visual C++ 2005 DLL -> Microsoft" "AppointmentApis.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "apphelp.dll" was detected as "Visual C++ 2003 DLL -> Microsoft"8e:T5f7,"MSOCF.dll" has resource with unusual entropy "RT_ICON:7.3610967852189395" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.903437749511489" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.975854547211234" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.970776886564805" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.977974520644237" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.965957737466065" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.970386719868462" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.9756748869194505" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.976302122138195" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.985062294225375" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.9741880126239035" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.553457005565576" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.986457254075343" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.969381675862415" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.953672771388162" "appwiz.cpl" has resource with unusual entropy "RT_ICON:7.985151320986029" "appwiz.cpl" has resource with unusual entropy "RT_ICON:7.785566915725667" "appwiz.cpl" has resource with unusual entropy "RT_ICON:7.9475927305345895"8f:T3ba3,"aclui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWSnapin.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "accessibilitycpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcGenral.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cmiv2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "batmeter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActiveSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppVEntSubsystems32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "AppxPackaging.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AzureSettingSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AudioEng.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AudioSes.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "aadtb.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "bcastdvr.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "autochk.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "autoconv.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "adtschema.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "autofmt.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "azroles.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "appwiz.cpl" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppointmentApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apphelp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00004528] "AppxApplicabilityEngine.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppContracts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppXDeploymentClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenterCPL.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcSpecfc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advapi32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00004528] "authui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AdmTmpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ActivationManager.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppResolver.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AUDIOKSE.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AcLayers.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00004528] "appmgr.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AccountsRt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "authfwcfg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "azroleui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atmfd.dll" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 6 sections"- [targetUID: N/A] "AuthFWGP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsnt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppIdPolicyEngineApi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "actxprxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AboveLockAppHost.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "audiodev.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppLockerCSP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "activeds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuditNativeSnapIn.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "accountaccessor.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aepic.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsldpc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "adsldp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppxAllUserStore.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "authz.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "basecsp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthBroker.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "appmgmts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "altspace.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "AppxSip.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aadauthhelper.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "autoplay.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppExtension.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppManagementConfiguration.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppointmentActivation.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advpack.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuthFWWizFwk.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "avifil32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adrclient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpolmsg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AuthBrokerUI.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "adsmsext.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcXtrnal.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppCapture.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "amstream.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "asycfilt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "msimsg.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "avicap32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00003624] "acppage.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bcastdvr.proxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ApiSetHost.AppExecutionAlias.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BackgroundMediaPolicy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "comdlg32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AuditPolicyGPInterop.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpolcore.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuthExt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AddressParser.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appidapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "amsi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adprovider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AtBroker.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "APHostClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "admwprox.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cdosys.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "windows.ui.xaml.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "atmlib.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acwow64.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AdaptiveCards.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atlthunk.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BackgroundTransferHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AcWinRT.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "SyncRes.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "Apphlpdm.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aeevts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "ActivationClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aspnet_counters.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpol.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "avrt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppVClientPS.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ahadmin.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aspperf.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AzSqlExt.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "at.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "appidtel.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "AnalogCommonProxyStub.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "attrib.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "backgroundTaskHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AppVTerminator.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "mlang.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "fms.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AppVSentinel.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BamSettingsClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "apprepapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acledit.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "comctl32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "quickassist.exe.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "asferror.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "advapi32res.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "activeds.tlb" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "EmbeddedDriverService.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections"- Location: [%TEMP%\EmbeddedDriverService.sys]- [targetUID: 00000000-00004528] "ARP.EXE" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "amcompat.tlb" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A]90:T819,"rundll32.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00002060) "rundll32.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00002060)91:T5fc,"Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00002060.00000001.253574.04FD0000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00002340.00000001.253569.04B10000.00000004.mdmp 00000000-00002340.00000001.253569.04DC0000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00003624.00000000.253892.04B60000.00000004.mdmp 00000000-00003624.00000000.253892.04C60000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00004292.00000000.253911.04B90000.00000040.mdmp 00000000-00004292.00000000.253911.04F40000.00000004.mdmp 00000000-00004292.00000000.253911.050C0000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00004468.00000000.253908.00860000.00000004.mdmp 00000000-00004468.00000000.253908.04D80000.00000004.mdmp 00000000-00004468.00000000.253908.04F60000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00004528.00000000.253897.04E90000.00000004.mdmp 00000000-00004528.00000000.253897.04F90000.00000040.mdmp92:T5b0,"AuthFWSnapin.dll" claimed CRC 962767 while the actual is CRC 5162289 "accessibilitycpl.dll" claimed CRC 5162289 while the actual is CRC 3850339 "AcGenral.dll" claimed CRC 3850339 while the actual is CRC 2417448 "cmiv2.dll" claimed CRC 2417448 while the actual is CRC 2098028 "batmeter.dll" claimed CRC 2098028 while the actual is CRC 1726777 "ActiveSyncProvider.dll" claimed CRC 1726777 while the actual is CRC 1554521 "AppVEntSubsystems32.dll" claimed CRC 1554521 while the actual is CRC 1522308 "AppxPackaging.dll" claimed CRC 1522308 while the actual is CRC 1313375 "AzureSettingSyncProvider.dll" claimed CRC 1313375 while the actual is CRC 1327570 "AudioEng.dll" claimed CRC 1327570 while the actual is CRC 1292514 "AudioSes.dll" claimed CRC 1292514 while the actual is CRC 1020559 "aadtb.dll" claimed CRC 1020559 while the actual is CRC 978596 "bcastdvr.exe" claimed CRC 978596 while the actual is CRC 914059 "autochk.exe" claimed CRC 914059 while the actual is CRC 880836 "autoconv.exe" claimed CRC 880836 while the actual is CRC 886967 "adtschema.dll" claimed CRC 886967 while the actual is CRC 871876 "autofmt.exe" claimed CRC 871876 while the actual is CRC 867458 "azroles.dll" claimed CRC 867458 while the actual is CRC 824233 "appwiz.cpl" claimed CRC 824233 while the actual is CRC 817447 "AppointmentApis.dll" claimed CRC 817447 while the actual is CRC 687878 "apphelp.dll" claimed CRC 687878 while the actual is CRC 67308293:T659,VirtualAlloc UnhandledExceptionFilter GetCommandLineA WriteFile GetModuleHandleW GetModuleHandleA GetModuleHandleExW GetProcAddress GetModuleFileNameW Sleep OutputDebugStringW IsDebuggerPresent CreateFileW LoadLibraryExW GetTempPathW GetStartupInfoW TerminateProcess GetModuleFileNameA DeleteFileW GetFileAttributesW CreateProcessW OpenProcess RegEnumKeyExW ShellExecuteW ShellExecuteExW GetWindowThreadProcessId FindResourceExW LockResource LoadLibraryW RegCreateKeyExW RegCloseKey RegDeleteValueW RegOpenKeyExW GetTickCount OpenProcessToken DeleteFileA CreateFileMappingW GetCommandLineW CreateProcessA GetTempFileNameW FindNextFileA CopyFileA FindResourceA VirtualProtect WriteProcessMemory GetDriveTypeW CopyFileW CreateThread FindResourceW GetTickCount64 OutputDebugStringA GetVersionExW MapViewOfFile GetFileAttributesA LoadLibraryA GetTempFileNameA GetLogicalDrives CreateFileMappingA DeviceIoControl GetFileSize GetTempPathA CreateToolhelp32Snapshot CreateFileA FindFirstFileW GetSystemDirectoryA VirtualAllocEx GetSystemInfo GetSystemDirectoryW GetDriveTypeA FindNextFileW ReadProcessMemory ShellExecuteExA GetUserNameExW SetWindowsHookExA GetUpdateRgn EnumPrintersA RegOpenKeyExA SetSecurityDescriptorDacl CreateServiceW StartServiceW ChangeServiceConfigW NtQueryInformationThread NtQueryInformationToken NtQueryInformationProcess ChangeServiceConfig2W RegDeleteKeyW GetFileSizeEx GetVersionExA CreateDirectoryW GetFileAttributesExW NtQueryInformationFile LdrLoadDll RegOpenKeyW CreateThreadpoolTimer CreateProcessAsUserW94:T42b,"AuthFWSnapin.dll" claims program is from Fri Dec 7 14:59:21 2057 "accessibilitycpl.dll" claims program is from Tue Aug 7 19:36:59 2035 "AcGenral.dll" claims program is from Fri May 19 08:40:06 2102 "cmiv2.dll" claims program is from Thu Jan 4 16:58:21 1996 "AppVEntSubsystems32.dll" claims program is from Sun Jun 2 09:01:48 1996 "AppxPackaging.dll" claims program is from Mon Apr 14 06:51:56 2036 "AzureSettingSyncProvider.dll" claims program is from Wed Apr 19 10:42:29 2079 "AudioEng.dll" claims program is from Tue Jan 9 01:17:41 1990 "AudioSes.dll" claims program is from Thu Dec 5 03:45:56 2080 "bcastdvr.exe" claims program is from Fri Feb 4 20:21:59 2056 "autochk.exe" claims program is from Mon Oct 15 16:58:02 2074 "autoconv.exe" claims program is from Thu Dec 8 09:41:24 2061 "adtschema.dll" claims program is from Mon May 31 12:41:32 1971 "azroles.dll" claims program is from Sat Dec 24 13:16:04 2072 "appwiz.cpl" claims program is from Thu Sep 19 20:29:58 2047 "AppointmentApis.dll" claims program is from Mon May 30 16:59:18 205095:T679,"rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "9200940000000000f800690000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "9200940000000000f8f93b0300000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "920094000000000000fa890000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "9200940000000000c8fc7f0000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "9200940000000000f8f98a0000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "9200940000000000b8f9c60000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "920094000000000018018b0000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"}96:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==97:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==98:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==99:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==9a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==9b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==9c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==9d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACZmZmQAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAJmZmZmZmZmZmQAAAAAACZmZmZmZmZmZmZkAAAAACZmZmZmQAACZmZmZAAAAAAmZAAAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZkAAAAAAJmZmZkAAAAACZmZAAAAAACZmZmZAAAAAAmZmQAAAAAAmZmZmQAAAAAJmZmZmQAAAJmZmZkAAAAACZmZmZmZmQCZmZmZAAAAAACZmZmZmZmZmZmZmQAAAAAAAAmZmZmZmZmZmZkAAAAAAAAAAJmZmZmZmZmZAAAAAAAAAAAAmZmZmZmZkAAAAAAAAAAAAAAJmZmZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////+A///8AA//4AAH/wAAB/wA+Af8f/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/B/4B/wf+Af8H/gH/AH4B/wAGAf+AAAH/8AAB//4AAf//gAP///Af///////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790540284446,"unified_at":"2026-09-27T20:18:04.446Z","metadata":{"hashes":{"sha256":"041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","sha1":"0ec1932a9ea007c80126b2d5801304b79fc4808f","md5":"dc019e9977416c7e2daa64257c648535","sha512":"e744a2bbab727e43efb3a1483bf0ec2fbd881223328bb7ffe1bed49ae01baadcdb19fe23e578db52e990b4029b46d60afd0039612bee19c8403546a56de3d212","ssdeep":"3072:c/YlPe/tTM+9ufk2Nk3Y+nsietwZTtcihJibnqtaKR2jpZ5ydOtydMgtPeLdTxgT:c/xMOWa3","ssdeep_chunks":["3072:c/YlPe/","3072:/YlPe/t","3072:YlPe/tT","3072:lPe/tTM","3072:Pe/tTM+","3072:e/tTM+9","3072:/tTM+9u","3072:tTM+9uf","3072:TM+9ufk","3072:M+9ufk2","3072:+9ufk2N","3072:9ufk2Nk","3072:ufk2Nk3","3072:fk2Nk3Y","3072:k2Nk3Y+","3072:2Nk3Y+n","3072:Nk3Y+ns","3072:k3Y+nsi","3072:3Y+nsie","3072:Y+nsiet","3072:+nsietw","3072:nsietwZ","3072:sietwZT","3072:ietwZTt","3072:etwZTtc","3072:twZTtci","3072:wZTtcih","3072:ZTtcihJ","3072:TtcihJi","3072:tcihJib","3072:cihJibn","3072:ihJibnq","3072:hJibnqt","3072:Jibnqta","3072:ibnqtaK","3072:bnqtaKR","3072:nqtaKR2","3072:qtaKR2j","3072:taKR2jp","3072:aKR2jpZ","3072:KR2jpZ5","3072:R2jpZ5y","3072:2jpZ5yd","3072:jpZ5ydO","3072:pZ5ydOt","3072:Z5ydOty","3072:5ydOtyd","3072:ydOtydM","3072:dOtydMg","3072:OtydMgt","3072:tydMgtP","3072:ydMgtPe","3072:dMgtPeL","3072:MgtPeLd","3072:gtPeLdT","3072:tPeLdTx","3072:PeLdTxg","3072:eLdTxgT","6144:c/YlPe/","6144:/YlPe/t","6144:YlPe/tT","6144:lPe/tTM","6144:Pe/tTM+","6144:e/tTM+9","6144:/tTM+9u","6144:tTM+9uf","6144:TM+9ufk","6144:M+9ufk2","6144:+9ufk2N","6144:9ufk2Nk","6144:ufk2Nk3","6144:fk2Nk3Y","6144:k2Nk3Y+","6144:2Nk3Y+n","6144:Nk3Y+ns","6144:k3Y+nsi","6144:3Y+nsie","6144:Y+nsiet","6144:+nsietw","6144:nsietwZ","6144:sietwZT","6144:ietwZTt","6144:etwZTtc","6144:twZTtci","6144:wZTtcih","6144:ZTtcihJ","6144:TtcihJi","6144:tcihJib","6144:cihJibn","6144:ihJibnq","6144:hJibnqt","6144:Jibnqta","6144:ibnqtaK","6144:bnqtaKR","6144:nqtaKR2","6144:qtaKR2j","6144:taKR2jp","6144:aKR2jpZ","6144:KR2jpZ5","6144:R2jpZ5y","6144:2jpZ5yd","6144:jpZ5ydO","6144:pZ5ydOt","6144:Z5ydOty","6144:5ydOtyd","6144:ydOtydM","6144:dOtydMg","6144:OtydMgt","6144:tydMgtP","6144:ydMgtPe","6144:dMgtPeL","6144:MgtPeLd","6144:gtPeLdT","6144:tPeLdTx","6144:PeLdTxg","6144:eLdTxgT","3072:c/xMOWa","3072:/xMOWa3"],"imphash":"fc1d45e2b662c656e1a56e88c9fc63e6","pehash":"504c98e78717fe1cb960cf7c6089c5988879e3cb"},"file_info":{"file_name":"MSOCF.dll","file_type":["pedll","executable"],"file_type_id":"dll","file_size":950784,"entropy":3.28,"compile_timestamp":"2026-08-23T13:51:11","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1787531435000,"last_seen":1787984020000,"last_multi_scan":1787984020000},"pe_metadata":{"is_dll":true,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":76932,"raw_size":77312},{"name":".rdata","virtual_address":"0x14000","virtual_size":27172,"raw_size":27648},{"name":".data","virtual_address":"0x1b000","virtual_size":15904,"raw_size":8192},{"name":".reloc","virtual_address":"0x1f000","virtual_size":3808,"raw_size":4096},{"name":".rsrc","virtual_address":"0x20000","virtual_size":832448,"raw_size":832512}],"section_names":[".text",".rdata",".data",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":106},"sandbox_signatures":{"informative_count":277,"suspicious_count":28,"malicious_count":8,"total":313},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.MalwareX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.DLLhijack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81178168","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81178168 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/ShellcodeRunner.AGW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 006e59681 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABmTrojan.UQKM-7854","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"References Video COM interface string"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"malicious","value":"Drops system driver"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Calls an API typically used to stop a service"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"malicious","value":"Unloads system drivers using native API calls"},{"type":"informative","value":"Able to unregister service from Service Control Manager"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"informative","value":"Contains ability to add users to a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains ability to connect to a messaging system (API string)"},{"type":"informative","value":"Contains ability to query/modify memory allocated by messaging system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"LSASS Driver","attack_id":"T1547.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/008","identifiers":[{"type":"malicious","value":"Loads a device driver"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"suspicious","value":"References COM interfaces strings prone to UAC bypass"},{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Uses Windows cryptography API for obfuscation"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to delete device driver (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Deletes registry keys"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Able to retrieve event logs (API string)"},{"type":"informative","value":"Contains ability to delete all entries from an event log (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match – PEB traversal"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"},{"type":"informative","value":"Contains ability to register RPC protocol sequence (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Detected Suricata Alert - CnC Activity"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Detected Suricata alert – Encrypted channel"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Imports crypto-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandleExW\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"basecsp.dll\")\n file/memory contains long string(File: \"AppxSip.dll\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to retrieve event logs (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"$29","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlComputeCrc32\" (Indicator: \"RtlComputeCrc32\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delete all entries from an event log (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-211","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"MSOCF.dll\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"aadauthhelper.dll\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"aadauthhelper.dll\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"AppxSip.dll\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"ARP.EXE\")\n Found reference to \"UsOidToCalendarUdmId\" (Indicator: \"Oid\"; File: \"MSOCF.dll\")\n Found reference to \"UsOidToTaskUdmId\" (Indicator: \"Oid\"; File: \"MSOCF.dll\")\n Found reference to \"UsOidToContactUdmId\" (Indicator: \"Oid\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$31","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$33","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"rundll32.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"RT_BSS\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"ActionCenter.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"activeds.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"adsldpc.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"adsldp.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"adsmsext.dll\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004528.00000000.253897.00C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$34","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$35","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 65233-92-1000CA52\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 65233-92-1000CA52\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 65233-156-100092FF\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 65233-156-100092FF\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 65233-437-10009C8E\n Assembly shows XOR instruction xor ecx\n eax in Stream UID: 65233-437-10009C8E\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 65233-437-10009C8E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptBinaryToStringW\" (Indicator: \"CryptBinaryToString\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptAcquireCertificatePrivateKey\" (Indicator: \"CryptAcquireCertificatePrivateKey\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$37","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: aadtb.dll]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: aadtb.dll]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$38","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$39","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"adsldpc.dll\")\n file/memory contains long string(File: \"adsldp.dll\")\n file/memory contains long string(File: \"appmgmts.dll\")\n file/memory contains long string(File: \"adrclient.dll\")\n file/memory contains long string(File: \"adprovider.dll\")\n file/memory contains long string(File: \"activeds.tlb\")\n Found string \"etUserNameExA\" (Source: \"00000000-00003624.00000000.253892.00880000.00000004.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00004292.00000000.253911.00910000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00004292.00000000.253911.00910000.00000004.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00004468.00000000.253908.00860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"AUDIOKSE.dll\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"ActionCenter.dll\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"audiodev.dll\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"AppxAllUserStore.dll\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"AppManagementConfiguration.dll\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"appidapi.dll\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"BamSettingsClient.dll\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"MSOCF.dll\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007344.00000000.251961.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"basecsp.dll\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"ApiSetHost.AppExecutionAlias.dll\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"AtBroker.exe\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"MSOCF.dll\")\n Found string \"QueryServiceStatusEx\" (File: \"MSOCF.dll\")\n Found string \"QueryServiceConfigW\" (File: \"MSOCF.dll\")\n Found string \"QueryServiceConfig2W\" (File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"adrclient.dll\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002340-00000C2C-2927919404\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"MSOCF.dll\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"file/memory contains long string with (Indicator: \"getcomputerobjectname\"; File: \"adsldp.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002340)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007524)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007344)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002060)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003624)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004528)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004468)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004292)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00002340)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002340)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: AudioEng.dll)\n Observed import api PathFindFileName (Source: appwiz.cpl)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"rundll32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002060)\n \"rundll32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"rundll32.exe\" called \"GetWindowTextW\" (UID: 00000000-00002060)\n \"rundll32.exe\" called \"GetWindowTextW\" (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002340)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007524)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007344)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002060)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"rundll32.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002060)\n \"rundll32.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"rundll32.exe\" called \"GetLocaleInfoW\" with parameter \"2048\" - (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"$43","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"MSOCF.dll\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"MSOCF.dll\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007344.00000000.251961.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"MSOCF.dll\")\n Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; File: \"MSOCF.dll\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"MSOCF.dll\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"MSOCF.dll\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; File: \"MSOCF.dll\")\n Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"MSOCF.dll\")\n Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; File: \"MSOCF.dll\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"rundll32.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$47","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Environment Awareness","name":"References Video COM interface string","description":"Found string \"CLSID\\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\" (Indicator: \"{62be5d10-60eb-11d0-bd3b-00a0c911ce86}\"; Source: \"00000000-00002060.00000001.253574.007D0000.00000004.mdmp\")\n Found string \"CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\" (Indicator: \"{860bb310-5d01-11d0-bd3b-00a0c911ce86}\"; Source: \"00000000-00002060.00000001.253574.007D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-757","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA Applayer Protocol detection skipped\" (SID: 2260003, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 1339)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"AppLockerCSP.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"AppxAllUserStore.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"appmgmts.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"AppxSip.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"advpack.dll\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"MSOCF.dll\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"MSOCF.dll\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"202.61.140.222:448\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; File: \"MSOCF.dll\")\n Found reference to API \"NetLocalGroupAdd\" (Indicator: \"NetLocalGroupAdd\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to connect to a messaging system (API string)","description":"Found reference to API \"MAPILogonEx\" (Indicator: \"MAPILogonEx\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-178","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AcGenral.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: AppVEntSubsystems32.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"MSOCF.dll\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"MSOCF.dll\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify memory allocated by messaging system (API string)","description":"Found reference to API \"MAPIFreeBuffer\" (Indicator: \"MAPIFreeBuffer\"; File: \"MSOCF.dll\")\n Found reference to API \"MAPIAllocateBuffer\" (Indicator: \"MAPIAllocateBuffer\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-233","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$54","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: AcGenral.dll)\n Found MoveFileExW in import section (Source: cmiv2.dll)\n Found MoveFileW in import section (Source: appwiz.cpl)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$56","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"DLL with no export directory","description":"\"AuthFWSnapin.dll\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"bcastdvr.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"autochk.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"autoconv.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"adtschema.dll\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"autofmt.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"","origin":"Static Parser","relevance":1,"id":"static-91","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$57","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#1\" (UID: 00000000-00002340)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#2\" (UID: 00000000-00007524)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#3\" (UID: 00000000-00007344)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#4\" (UID: 00000000-00002060)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#5\" (UID: 00000000-00003624)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#6\" (UID: 00000000-00004528)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#7\" (UID: 00000000-00004468)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#8\" (UID: 00000000-00004292)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$58","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mode.rich.rdata@.rsrc.rdata.rdata\"\n Pattern match: \"mode.rich.text@.rsrc.rdata.rdata\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$59","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$5a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D60000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73260000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76470000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$5b","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"AuthFWSnapin.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$5d","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$5e","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$5f","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$60","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x4dd400\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x370a00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x18c200\" greater than 0x100000\n Raw size of \".text\" is \"0x1a0e00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x18e600\" greater than 0x100000\n Raw size of \".text\" is \"0x15d200\" greater than 0x100000\n Raw size of \".text\" is \"0x144400\" greater than 0x100000\n Raw size of \".text\" is \"0x122400\" greater than 0x100000\n Raw size of \".text\" is \"0x10e800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4dd298\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x370928\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x18c038\" greater than 0x100000\n Virtual size of \".text\" is \"0x1a0d12\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x18e470\" greater than 0x100000\n Virtual size of \".text\" is \"0x15d1a5\" greater than 0x100000\n Virtual size of \".text\" is \"0x144246\" greater than 0x100000\n Virtual size of \".text\" is \"0x1222cb\" greater than 0x100000\n Virtual size of \".text\" is \"0x10e621\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"AcGenral.dll\" has high imagebase \"0x79000000\"\n \"appwiz.cpl\" has high imagebase \"0x71900000\"\n \"apphelp.dll\" has high imagebase \"0x78c80000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00002340) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00002340) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"file/memory contains long string(File: \"adsldpc.dll\")\n file/memory contains long string(File: \"adsldp.dll\")\n file/memory contains long string(File: \"authz.dll\")\n file/memory contains long string(File: \"adsmsext.dll\")\n file/memory contains long string(File: \"adprovider.dll\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#2\" (UID: 00000000-00007524)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#3\" (UID: 00000000-00007344)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#4\" (UID: 00000000-00002060)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#5\" (UID: 00000000-00003624)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#6\" (UID: 00000000-00004528)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#7\" (UID: 00000000-00004468)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#8\" (UID: 00000000-00004292)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#2\" (UID: 00000000-00007524)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#3\" (UID: 00000000-00007344)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#4\" (UID: 00000000-00002060)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#5\" (UID: 00000000-00003624)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#6\" (UID: 00000000-00004528)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#7\" (UID: 00000000-00004468)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#8\" (UID: 00000000-00004292)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$61","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sys_cache.dat\"\n \"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(File: \"accountaccessor.dll\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; File: \"MSOCF.dll\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$63","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"AppxProvisioning.xml\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$65","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 2340)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 7524)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 7344)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 2060)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 4528)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 4468)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 4292)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$66","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rundll32.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\sys_cache.dat\"\n \"rundll32.exe\" reads file \"c:\\windows\\syswow64\\rundll32.exe\"\n \"rundll32.exe\" reads file \"c:\\windows\\syswow64\\svchost.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$67","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\AcLayers.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\WINLOGON.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSDTC.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\SIHOST.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\TASKHOSTW.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RUNTIMEBROKER.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\APPLICATIONFRAMEHOST.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\CONHOST.EXE\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\MSOCF.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\MSOCF.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\MSOCF.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\MSOCF.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\MSOCF.DLL.2.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RUNDLL32.EXE.LOCAL\"\n \"rundll32.exe\" trying to access non-existent file \"STProcessMonitorDriver\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\RasAcd\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EMBEDDEDDRIVERSERVICE.SYS\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\sys_cache.dat\"\n \"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\embeddeddriverservice.sys\"\n \"rundll32.exe\" writes file \"%temp%\\sys_cache.dat\"\n \"rundll32.exe\" writes file \"%temp%\\embeddeddriverservice.sys\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"rundll32.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sys_cache.dat\"\n \"rundll32.exe\" writes a file \"%TEMP%\\sys_cache.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"file/memory contains long string with (Indicator: \"WNetGetUniversalName\"; File: \"adrclient.dll\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"authfwcfg.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"authz.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"appidapi.dll\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"MSOCF.dll\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"MSOCF.dll\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00002340-00000C2C-2927919281\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00002340-00000C2C-2927919822\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"202.61.140.222\"\n \"02.61.140.222\"\n Potential IPs \"202.61.140.222\"\n \"202.61.140.222\"\n \"127.0.0.1\" found in string \"|p1:202.61.140.222|o1:448|t1:1|p2:202.61.140.222|o2:448|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:\"\n \"127.0.0.1\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$6d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetLocalGroupAdd\" which can \"create a local group in the security database.\" [Source: AcGenral.dll]\n Observed import api \"NetLocalGroupAddMembers\" which can \"add membership of one or more existing user accounts or global group accounts to an existing local group.\" [Source: AcGenral.dll]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: AcGenral.dll]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"AddressParser.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"altspace.dll\"\n YARA signature for RSA public and private key matched on file \"AuthFWSnapin.dll\"\n YARA signature for RSA public and private key matched on file \"AuthFWWizFwk.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00004468\"\n YARA signature matched on embedded PE in process \"00000000-00004292\"\n YARA signature matched on embedded PE in process \"00000000-00007344\"\n YARA signature matched on embedded PE in process \"00000000-00004528\"\n YARA signature matched on embedded PE in process \"00000000-00003624\"\n YARA signature matched on embedded PE in process \"00000000-00007524\"\n YARA signature matched on embedded PE in process \"00000000-00002340\"\n YARA signature matched on embedded PE in process \"00000000-00002060\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"$6e","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00004528\"\n YARA signature for PEB traversal process \"00000000-00004292\"\n YARA signature for PEB traversal process \"00000000-00004468\"\n YARA signature for PEB traversal process \"00000000-00002340\"\n YARA signature for PEB traversal process \"00000000-00003624\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"AuthFWSnapin.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"MSOCF.dll\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to register RPC protocol sequence (API string)","description":"Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-454","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE816FAD7A8182DE792EFD6849F7AE]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002060.00000001.253574.007D0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002060.00000001.253574.007D0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE79A7CD966A6037BA8CB6164154E2]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002060.00000001.253574.007D0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE816FAD7A8182DE792EFD6849F7AE]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002060.00000001.253574.007D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"file/memory contains long string with (Indicator: \"kerberos\"; File: \"authz.dll\")\n file/memory contains long string with (Indicator: \"kerberos\"; File: \"adsmsext.dll\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"azroleui.dll\")\n file/memory contains long string(File: \"avicap32.dll\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"$70","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSOCF.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: AcGenral.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: AppVEntSubsystems32.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: AppVEntSubsystems32.dll]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"$74","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"rundll32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"rundll32.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base32\"; File: \"AppxAllUserStore.dll\")\n file/memory contains long string with (Indicator: \"zipfile\"; File: \"AppxSip.dll\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"aadauthhelper.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: appwiz.cpl)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"accessibilitycpl.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"cmiv2.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"ActiveSyncProvider.dll\" contains export function called \"DllGetClassObject\" at ordinal 6\n \"AppxPackaging.dll\" contains export function called \"DllGetClassObject\" at ordinal 8\n \"AzureSettingSyncProvider.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"AudioEng.dll\" contains export function called \"DllGetClassObject\" at ordinal 4\n \"AudioSes.dll\" contains export function called \"DllGetClassObject\" at ordinal 6\n \"aadtb.dll\" contains export function called \"DllGetClassObject\" at ordinal 7\n \"azroles.dll\" contains export function called \"DllGetClassObject\" at ordinal 42\n \"appwiz.cpl\" contains export function called \"DllGetClassObject\" at ordinal 4\n \"AppointmentApis.dll\" contains export function called \"DllGetClassObject\" at ordinal 5","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"MSOCF.dll\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"MSOCF.dll\")\n Found reference to API \"RtlCheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"MSOCF.dll\")\n Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"MSOCF.dll\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"file/memory contains long string with (Indicator: \"security-credentials\"; File: \"basecsp.dll\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"AppLockerCSP.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"AppManagementConfiguration.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"appidtel.exe\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: AcGenral.dll]\n Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: cmiv2.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002340)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007524)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007344)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002060)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003624)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004528)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004468)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004292)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: AcGenral.dll]\n Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: cmiv2.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"$80","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$81","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"MSOCF.dll\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$84","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"$85","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"MSOCF.dll\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"MSOCF.dll\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"MSOCF.dll\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00007344.00000000.251961.01239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"MSOCF.dll\")\n Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; File: \"MSOCF.dll\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$88","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"TYPE\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"START\"; Value: \"0300000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"ERRORCONTROL\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"IMAGEPATH\"; Value: \"%TEMP%\\EmbeddedDriverService.sys\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$89","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"rundll32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$8a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"TYPE\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"START\"; Value: \"0300000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"ERRORCONTROL\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"IMAGEPATH\"; Value: \"%TEMP%\\EmbeddedDriverService.sys\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$8b","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$8c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"EmbeddedDriverService.sys\" has type \"PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections\"- Location: [%TEMP%\\EmbeddedDriverService.sys]- [targetUID: 00000000-00004528]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"@WirelessDisplayToast.png\" has type \"PNG image data 64 x 64 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"@VpnToastIcon.png\" has type \"PNG image data 64 x 64 4-bit colormap non-interlaced\" and extension \"png\"\n \"@EnrollmentToastIcon.png\" has type \"PNG image data 71 x 71 8-bit gray+alpha non-interlaced\" and extension \"png\"\n \"@AudioToastIcon.png\" has type \"PNG image data 44 x 44 8-bit gray+alpha non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$8d","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"??\\C:\\Windows\\System32\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (5100184 bytes)\n possible junk padding\n Section \".didat\" has very low entropy (0.28)\n indicating potential NOP sled\n Section \".didat\" has very low entropy (0.08)\n indicating potential NOP sled\n Section \".didat\" has very low entropy (0.40)\n indicating potential NOP sled\n Section \".detourd\" has very low entropy (0.07)\n indicating potential NOP sled\n Section \"RT_DATA\" has very low entropy (0.25)\n indicating potential NOP sled\n Section \".didat\" has very low entropy (0.79)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"AudioEng.dll\" has section name .text with entropy \"7.028127229084725\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\sys_cache.dat\" has high entropy 7.9063","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses Windows cryptography API for obfuscation","description":"Observed Cryptography api used in \"advapi32.dll\" [Source: azroles.dll]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":3,"id":"static-207","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert - CnC Activity","description":"Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message\" (SID: 2052875, Rev: 7, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response\" (SID: 2059975, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","mitre_attack_id":"T1071","relevance":1,"id":"suricata-7","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata alert – Encrypted channel","description":"Detected Encrypted Channel activity \"ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response\" (SID: 2059975, Rev: 2, Severity: 1) categorized as \"Malware Command and Control Activity Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1573","relevance":6,"id":"suricata-17","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"rundll32.exe\" called \"OpenSCManagerA\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)\n \"rundll32.exe\" called \"OpenSCManagerA\" requesting access rights \"SC_MANAGER_CREATE_SERVICE\" (0x2)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$8e","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"rundll32.exe\" called \"OpenServiceA\" to access the \"EmbeddedDriverService\" service requesting \"SERVICE_ALL_ACCESS\" (0XF01FF) access rights","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$8f","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"rundll32.exe\" wrote 35400 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"rundll32.exe\" called \"gethostname\" with parameters (UID: 00000000-00002060)\n \"rundll32.exe\" called \"gethostname\" with parameters (UID: 00000000-00003624)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\SysWOW64\\rundll32.exe\" connects to 202.61.140.222 on port 448 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"rundll32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"rundll32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"rundll32.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00002340)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"$90","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"rundll32.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"rundll32.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"rundll32.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to stop a service","description":"\"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 897520\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 877138\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 927520","origin":"API Call","mitre_attack_id":"T1489","relevance":10,"id":"api-277","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\CC\\0\"; Key: \"R32F351A4AEEA5E608853D1A56661059\"; Value: \"\")\n \"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\CONSOLE\\0\"; Key: \"3C55EC603B6008FE03B40915B595078E\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"System Security","name":"References COM interfaces strings prone to UAC bypass","description":"$91","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":7,"id":"string-73","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$92","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$93","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"$94","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"rundll32.exe\" connects to 202.61.140.222:448","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"autochk.exe\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections\"\n \"autoconv.exe\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections\"\n \"autofmt.exe\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections\"\n \"atmfd.dll\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 6 sections\"\n \"EmbeddedDriverService.sys\" has type \"PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads a device driver","description":"\"rundll32.exe\" loaded driver \"NtLoadDriver\"","origin":"API Call","mitre_attack_id":"T1547.008","relevance":10,"id":"api-41","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00002340)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00007524)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00007344)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00004528)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00004468)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00004292)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"rundll32.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"level":"malicious","category":"System Security","name":"Unloads system drivers using native API calls","description":"$95","origin":"API Call","mitre_attack_id":"T1543.003","relevance":10,"id":"api-319","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}],"intel_graph":{"map":{"File:035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f":{"type":"File","value":"035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f"},"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51":{"type":"File","value":"041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51"},"File:06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633":{"type":"File","value":"06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633"},"File:086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931":{"type":"File","value":"086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931"},"File:0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085":{"type":"File","value":"0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085"},"File:14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6":{"type":"File","value":"14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6"},"File:16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e":{"type":"File","value":"16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e"},"File:17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454":{"type":"File","value":"17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454"},"File:181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568":{"type":"File","value":"181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568"},"File:191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd":{"type":"File","value":"191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd"},"File:1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2":{"type":"File","value":"1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2"},"File:1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a":{"type":"File","value":"1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a"},"File:207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73":{"type":"File","value":"207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73"},"File:223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543":{"type":"File","value":"223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543"},"File:224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c":{"type":"File","value":"224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c"},"File:2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180":{"type":"File","value":"2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180"},"File:2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a":{"type":"File","value":"2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a"},"File:255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498":{"type":"File","value":"255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498"},"File:25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e":{"type":"File","value":"25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e"},"File:25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb":{"type":"File","value":"25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb"},"File:26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490":{"type":"File","value":"26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490"},"File:273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec":{"type":"File","value":"273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec"},"File:281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395":{"type":"File","value":"281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395"},"File:28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933":{"type":"File","value":"28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933"},"File:2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6":{"type":"File","value":"2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6"},"File:2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25":{"type":"File","value":"2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25"},"File:2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0":{"type":"File","value":"2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0"},"File:30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462":{"type":"File","value":"30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462"},"File:325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18":{"type":"File","value":"325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18"},"File:32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac":{"type":"File","value":"32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac"},"File:35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5":{"type":"File","value":"35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5"},"File:374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4":{"type":"File","value":"374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4"},"File:3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc":{"type":"File","value":"3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc"},"File:389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd":{"type":"File","value":"389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd"},"File:38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713":{"type":"File","value":"38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713"},"File:393ebce96a09642211f015e135670fededa387246b3281d512137ce5c305faec":{"type":"File","value":"393ebce96a09642211f015e135670fededa387246b3281d512137ce5c305faec"},"File:3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366":{"type":"File","value":"3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366"},"File:422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7":{"type":"File","value":"422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7"},"File:43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f":{"type":"File","value":"43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f"},"File:4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081":{"type":"File","value":"4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081"},"File:495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88":{"type":"File","value":"495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88"},"File:4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3":{"type":"File","value":"4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3"},"File:4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191":{"type":"File","value":"4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191"},"File:4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a":{"type":"File","value":"4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a"},"File:4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82":{"type":"File","value":"4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82"},"File:528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98":{"type":"File","value":"528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98"},"File:5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945":{"type":"File","value":"5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945"},"File:56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4":{"type":"File","value":"56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4"},"File:574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2":{"type":"File","value":"574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2"},"File:58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b":{"type":"File","value":"58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b"},"File:59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c":{"type":"File","value":"59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c"},"File:5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637":{"type":"File","value":"5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637"},"File:5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca":{"type":"File","value":"5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca"},"File:5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b":{"type":"File","value":"5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b"},"File:61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650":{"type":"File","value":"61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650"},"File:64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d":{"type":"File","value":"64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d"},"File:67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a":{"type":"File","value":"67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a"},"File:68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b":{"type":"File","value":"68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b"},"File:700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2":{"type":"File","value":"700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2"},"File:70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b":{"type":"File","value":"70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"},"File:713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd":{"type":"File","value":"713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd"},"File:714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8":{"type":"File","value":"714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8"},"File:71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71":{"type":"File","value":"71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71"},"File:74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16":{"type":"File","value":"74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16"},"File:7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee":{"type":"File","value":"7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee"},"File:77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf":{"type":"File","value":"77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf"},"File:79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90":{"type":"File","value":"79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90"},"File:79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44":{"type":"File","value":"79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44"},"File:7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4":{"type":"File","value":"7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4"},"File:7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6":{"type":"File","value":"7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6"},"File:7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275":{"type":"File","value":"7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275"},"File:8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc":{"type":"File","value":"8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc"},"File:844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b":{"type":"File","value":"844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b"},"File:84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db":{"type":"File","value":"84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db"},"File:869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5":{"type":"File","value":"869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5"},"File:87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300":{"type":"File","value":"87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300"},"File:8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3":{"type":"File","value":"8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3"},"File:8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33":{"type":"File","value":"8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33"},"File:9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d":{"type":"File","value":"9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d"},"File:92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3":{"type":"File","value":"92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3"},"File:937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f":{"type":"File","value":"937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f"},"File:9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4":{"type":"File","value":"9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4"},"File:9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25":{"type":"File","value":"9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25"},"File:9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c":{"type":"File","value":"9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c"},"File:a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c":{"type":"File","value":"a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c"},"File:a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0":{"type":"File","value":"a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0"},"File:a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8":{"type":"File","value":"a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8"},"File:a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72":{"type":"File","value":"a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72"},"File:a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8":{"type":"File","value":"a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8"},"File:ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97":{"type":"File","value":"ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97"},"File:add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19":{"type":"File","value":"add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19"},"File:b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d":{"type":"File","value":"b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d"},"File:b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d":{"type":"File","value":"b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d"},"File:b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa":{"type":"File","value":"b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa"},"File:b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14":{"type":"File","value":"b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14"},"File:b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240":{"type":"File","value":"b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240"},"File:c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77":{"type":"File","value":"c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77"},"File:c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93":{"type":"File","value":"c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93"},"File:c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693":{"type":"File","value":"c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693"},"File:c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228":{"type":"File","value":"c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228"},"File:c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b":{"type":"File","value":"c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b"},"File:cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934":{"type":"File","value":"cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934"},"File:cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33":{"type":"File","value":"cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33"},"File:ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3":{"type":"File","value":"ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3"},"File:ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee":{"type":"File","value":"ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee"},"File:cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec":{"type":"File","value":"cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec"},"File:d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7":{"type":"File","value":"d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7"},"File:d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c":{"type":"File","value":"d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c"},"File:d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448":{"type":"File","value":"d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448"},"File:d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153":{"type":"File","value":"d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153"},"File:dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100":{"type":"File","value":"dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100"},"File:dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156":{"type":"File","value":"dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156"},"File:dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085":{"type":"File","value":"dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085"},"File:df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474":{"type":"File","value":"df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474"},"File:e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103":{"type":"File","value":"e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103"},"File:e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37":{"type":"File","value":"e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37"},"File:e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332":{"type":"File","value":"e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332"},"File:e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082":{"type":"File","value":"e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082"},"File:ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521":{"type":"File","value":"ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521"},"File:f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96":{"type":"File","value":"f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96"},"File:f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5":{"type":"File","value":"f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5"},"File:f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0":{"type":"File","value":"f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0"},"File:f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52":{"type":"File","value":"f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52"},"File:fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9":{"type":"File","value":"fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9"},"File:fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63":{"type":"File","value":"fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63"},"File:fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821":{"type":"File","value":"fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821"},"Ip:202.61.140.222":{"type":"Ip","value":"202.61.140.222"}},"chains":[{"id":"sandbox_network","root":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","edges":[{"edge_kind":"contacted_ip","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"Ip:202.61.140.222"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","edges":[{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:393ebce96a09642211f015e135670fededa387246b3281d512137ce5c305faec"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca"},{"edge_kind":"extracted","from_key":"File:041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51","to_key":"File:700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":37,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":125,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a8b90aa42101be22604c573","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["SGP"],"submit_name":"MSOCF.dll","analysis_start_time":"2026-08-24T00:30:35+00:00","indicators_count":{"informative":275,"suspicious":54,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"202.61.140.222","port":448,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}],"processes":[{"pid":6424,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00006424"},{"pid":2340,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002340","icon":"$96"},{"pid":7524,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007524","icon":"$97"},{"pid":7344,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007344","icon":"$98"},{"pid":2060,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002060","icon":"$99"},{"pid":3624,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003624","icon":"$9a"},{"pid":4528,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#6","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004528","icon":"$9b"},{"pid":4468,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#7","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004468","icon":"$9c"},{"pid":4292,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#8","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004292","icon":"$9d"}],"all_imported_dlls":["sechost.dll","powrprof.dll","NapiNSP.dll","pnrpnsp.dll","devenum.dll","wbemcomn.dll","wbemsvc.dll","kernel.appcore.dll","fltLib.dll","dxgi.dll","sfc.dll","dnsapi.dll","rasadhlp.dll","msdmo.dll","nlaapi.dll","apphelp.dll","shell32.dll","windows.storage.dll","profapi.dll","oleaut32.dll","VxSSL32.dll","winmm.dll","user32.dll","sfc_os.dll","clbcatq.dll","wbemprox.dll","fastprox.dll","wow64win.dll","combase.dll","nsi.dll","msasn1.dll","avicap32.dll","vcruntime140.dll","kernel32.dll","SHCore.dll","imm32.dll","ws2_32.dll","msvcp140.dll","KernelBase.dll","AcLayers.dll","msvcp_win.dll","ucrtbase.dll","cryptbase.dll","FWPUCLNT.DLL","uxtheme.dll","devobj.dll","ntdll.dll","advapi32.dll","mpr.dll","imagehlp.dll","comctl32.dll","wow64.dll","msvcrt.dll","gdi32.dll","shlwapi.dll","MSOCF.dll","mswsock.dll","winmmbase.dll","wow64cpu.dll","win32u.dll","cryptsp.dll","wintrust.dll","gdi32full.dll","cfgmgr32.dll","setupapi.dll","ole32.dll","crypt32.dll","rpcrt4.dll","bcrypt.dll","sspicli.dll","bcryptprimitives.dll","IPHLPAPI.DLL","GdiPlus.dll","ntmarta.dll","msvfw32.dll","winrnr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"aclui.dll","sha256":"cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuthFWSnapin.dll","sha256":"a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"accessibilitycpl.dll","sha256":"325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AcGenral.dll","sha256":"92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"cmiv2.dll","sha256":"b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"batmeter.dll","sha256":"4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ActiveSyncProvider.dll","sha256":"f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppVEntSubsystems32.dll","sha256":"181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppxPackaging.dll","sha256":"8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AzureSettingSyncProvider.dll","sha256":"b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AudioEng.dll","sha256":"d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AudioSes.dll","sha256":"c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"aadtb.dll","sha256":"c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"bcastdvr.exe","sha256":"4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"autochk.exe","sha256":"b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"autoconv.exe","sha256":"3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"adtschema.dll","sha256":"2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"autofmt.exe","sha256":"223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"azroles.dll","sha256":"c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"appwiz.cpl","sha256":"fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"EmbeddedDriverService.sys","sha256":"70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"apphelp.dll","sha256":"c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppxApplicabilityEngine.dll","sha256":"ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppXDeploymentClient.dll","sha256":"d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"advapi32.dll","sha256":"06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppResolver.dll","sha256":"58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AUDIOKSE.dll","sha256":"4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AcLayers.dll","sha256":"16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"atmfd.dll","sha256":"32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"aepic.dll","sha256":"14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppxAllUserStore.dll","sha256":"d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"basecsp.dll","sha256":"937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"altspace.dll","sha256":"2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppxSip.dll","sha256":"4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"advpack.dll","sha256":"224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuthFWWizFwk.dll","sha256":"191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"auditpolmsg.dll","sha256":"1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AddressParser.dll","sha256":"281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"appidapi.dll","sha256":"4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"aeevts.dll","sha256":"25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"aspnet_counters.dll","sha256":"25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"avrt.dll","sha256":"38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppVClientPS.dll","sha256":"a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"backgroundTaskHost.exe","sha256":"2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppVTerminator.dll","sha256":"086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppVSentinel.dll","sha256":"cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"asferror.dll","sha256":"374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"advapi32res.dll","sha256":"28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"sys_cache.dat","sha256":"a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppointmentApis.dll","sha256":"74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppContracts.dll","sha256":"d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ActionCenterCPL.dll","sha256":"5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AcSpecfc.dll","sha256":"dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"authui.dll","sha256":"0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AdmTmpl.dll","sha256":"cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ActivationManager.dll","sha256":"43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"appmgr.dll","sha256":"f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AccountsRt.dll","sha256":"87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"authfwcfg.dll","sha256":"713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"azroleui.dll","sha256":"207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuthFWGP.dll","sha256":"a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"adsnt.dll","sha256":"fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppIdPolicyEngineApi.dll","sha256":"f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"actxprxy.dll","sha256":"273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ActionCenter.dll","sha256":"26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AboveLockAppHost.dll","sha256":"e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"audiodev.dll","sha256":"add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppLockerCSP.dll","sha256":"59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"activeds.dll","sha256":"869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuditNativeSnapIn.dll","sha256":"7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"accountaccessor.dll","sha256":"79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"apds.dll","sha256":"389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"adsldpc.dll","sha256":"35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"adsldp.dll","sha256":"ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"authz.dll","sha256":"30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuthBroker.dll","sha256":"c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"appmgmts.dll","sha256":"495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"aadauthhelper.dll","sha256":"ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"autoplay.dll","sha256":"5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppExtension.dll","sha256":"8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppManagementConfiguration.dll","sha256":"2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppointmentActivation.dll","sha256":"a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"avifil32.dll","sha256":"dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"adrclient.dll","sha256":"56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuthBrokerUI.dll","sha256":"b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"adsmsext.dll","sha256":"574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AcXtrnal.dll","sha256":"7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AppCapture.dll","sha256":"e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"atl.dll","sha256":"422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"amstream.dll","sha256":"f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"asycfilt.dll","sha256":"ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"avicap32.dll","sha256":"8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"acppage.dll","sha256":"dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"bcastdvr.proxy.dll","sha256":"393ebce96a09642211f015e135670fededa387246b3281d512137ce5c305faec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ApiSetHost.AppExecutionAlias.dll","sha256":"3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"BackgroundMediaPolicy.dll","sha256":"fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuditPolicyGPInterop.dll","sha256":"528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"auditpolcore.dll","sha256":"77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AuthExt.dll","sha256":"71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"amsi.dll","sha256":"84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"adprovider.dll","sha256":"9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AtBroker.exe","sha256":"1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"APHostClient.dll","sha256":"9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"admwprox.dll","sha256":"714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"azman.msc","sha256":"2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"atmlib.dll","sha256":"035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"acwow64.dll","sha256":"68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AdaptiveCards.dll","sha256":"17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"atlthunk.dll","sha256":"7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"BackgroundTransferHost.exe","sha256":"255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AcWinRT.dll","sha256":"7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Apphlpdm.dll","sha256":"9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ActivationClient.dll","sha256":"67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"auditpol.exe","sha256":"e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ahadmin.dll","sha256":"5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"aspperf.dll","sha256":"79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AzSqlExt.dll","sha256":"e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"at.exe","sha256":"61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"appidtel.exe","sha256":"64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"AnalogCommonProxyStub.dll","sha256":"df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"attrib.exe","sha256":"b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"BamSettingsClient.dll","sha256":"844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"apprepapi.dll","sha256":"9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"acledit.dll","sha256":"5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"ARP.EXE","sha256":"700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"path":"%TEMP%\\sys_cache.dat","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"path":"%TEMP%\\EmbeddedDriverService.sys","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKCUHKCU\\CC\\0\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKCUHKCU\\CC\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\CONNECTIVITY\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\CONNECTIVITY\\NOEDID_15AD_0405_00000000_000F0000_0^20ED182961F2CFDB3A2D28C95A99744F\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\CONFIGURATION\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\CC\\0\\R32F351A4AEEA5E608853D1A56661059\\R32F351A4AEEA5E608853D1A56661059","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\\","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MyUniqueApp_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:2340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:2340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Global\\MyUniqueApp_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7524:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7524:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:7524:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:7524:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:7344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:7344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\BaseNamedObjects\\MyUniqueApp_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:2060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:2060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:3624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:3624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3624:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:4528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:4528:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:4468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:4468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"Local\\SM0:4292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]},{"name":"SM0:4292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b90aa42101be22604c573"}]}]}},"report_ids":{"sandbox_job_ids":["6a8b90aa42101be22604c573"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 041a0aeb76e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 041a0aeb76e6…. Malware family: Trojan.Generic. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 041a0aeb76e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 041a0aeb76e6…. Malware family: Trojan.Generic. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 041a0aeb76e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 041a0aeb76e6…. Malware family: Trojan.Generic. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L9e","11",{}]]