26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T476,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware_ Sample 0d4755125431… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0d4755125431…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5","keywords":["Malicious","Malware_","malware analysis","sandbox report","threat intelligence","0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5"],"about":{"@type":"SoftwareApplication","name":"Drv_ceo_12.8.1_x64.exe","applicationCategory":["compressed","7zip"],"identifier":"0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware_","antivirusDetections":{"malicious":1,"total":23},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T467,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "WinStationFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00007100.00000000.272518.00AE1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp")28:T4f0,Found reference string "cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; Source: "00000000-00005580-00000C46-15384330261") Found reference string "cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; Source: "00000000-00000312-00000C47-406792854") Found reference string "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" (Indicator: "add-mppreference"; Source: "00000000-00002280-00000C47-502557786") Found reference string "/C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "/C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" (Indicator: "add-mppreference"; Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000001.274074.03300000.00000004.mdmp") Found reference string "HostApplication=powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" (Indicator: "add-mppreference"; Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp")29:T8b2,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "nsExec.dll") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")2a:T56d,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")2b:T533,"tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "tasklist.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER32") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER32") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCHANDLER") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\INPROCSERVER32")2c:Ta22,"Drv_ceo_12.8.1_x64.exe" queried SystemProcessInformation at 00000000-00005580-00000C15-3256529517 [PID: 5580] "Drv_ceo_12.8.1_x64.exe" queried SystemProcessInformation at 00000000-00005580-00000C15-3256537234 [PID: 5580] "Drv_ceo_12.8.1_x64.exe" queried SystemProcessInformation at 00000000-00005580-00000C15-3256664963 [PID: 5580] "Drv_ceo_12.8.1_x64.exe" queried SystemProcessInformation at 00000000-00005580-00000C15-3256673678 [PID: 5580] "Drv_ceo_12.8.1_x64.exe" queried SystemProcessInformation at 00000000-00005580-00000C15-3263993319 [PID: 5580] "Drv_ceo_12.8.1_x64.exe" queried SystemProcessInformation at 00000000-00005580-00000C15-3264001619 [PID: 5580] "cmd.exe" queried SystemProcessInformation at 00000000-00002008-00000C15-3257663741 [PID: 2008] "cmd.exe" queried SystemProcessInformation at 00000000-00002008-00000C15-3257672195 [PID: 2008] "tasklist.exe" queried SystemProcessInformation at 00000000-00007100-00000C15-3258099872 [PID: 7100] "tasklist.exe" queried SystemProcessInformation at 00000000-00007100-00000C15-3258108840 [PID: 7100] "tasklist.exe" queried SystemProcessInformation at 00000000-00007100-00000C15-3258256341 [PID: 7100] "tasklist.exe" queried SystemProcessInformation at 00000000-00007100-00000C15-3258265314 [PID: 7100] "cmd.exe" queried SystemProcessInformation at 00000000-00000312-00000C15-3263166649 [PID: 312] "cmd.exe" queried SystemProcessInformation at 00000000-00000312-00000C15-3263175328 [PID: 312] "cmd.exe" queried SystemProcessInformation at 00000000-00002280-00000C15-3263529528 [PID: 2280] "cmd.exe" queried SystemProcessInformation at 00000000-00002280-00000C15-3263537520 [PID: 2280] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3264380804 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3264387637 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3265820369 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3265829741 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3267442986 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3267451338 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3268059757 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3268094502 [PID: 4248] "powershell.exe" queried SystemProcessInformation at 00000000-00004248-00000C15-3268345706 [PID: 4248]2d:T714,"Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ev2f79.exe.nhpart_eca71a8195ce" to "%APPDATA%\comain_ev2f79\ev2f79.exe" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ntrin.er.nhpart_8b7dd226f6f2" to "%APPDATA%\comain_ev2f79\ntrin.er" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\otrm.oi.nhpart_7529123106ed" to "%APPDATA%\comain_ev2f79\otrm.oi" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\yinma.vc.nhpart_39f7b8fb60cd" to "%APPDATA%\comain_ev2f79\yinma.vc" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\dxyvnb.ti.nhpart_d759ea87c9f5" to "%APPDATA%\comain_ev2f79\dxyvnb.ti" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\ev2c34.exe.nhpart_2d004296fcc8" to "%APPDATA%\comain_ev2c34\ev2c34.exe" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\bnymir.ou.nhpart_419feabca584" to "%APPDATA%\comain_ev2c34\bnymir.ou" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\bteuns.pt.nhpart_ce727a6be914" to "%APPDATA%\comain_ev2c34\bteuns.pt" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\cmrsk.ce.nhpart_809b48356e46" to "%APPDATA%\comain_ev2c34\cmrsk.ce" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\fhkan.oi.nhpart_393638b58a58" to "%APPDATA%\comain_ev2c34\fhkan.oi" "Drv_ceo_12.8.1_x64.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\ap.asin.nhpart_c03f8c02ae29" to "%APPDATA%\comain_ev2c34\ap.asin"2e:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2f:T1467,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007100-36883-206-00AEE5DB Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007100-36883-206-00AEE5DB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-207-00AEA0F9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-207-00AEA0F9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-212-00AEDC98 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-212-00AEDC98 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-217-00AE8EF4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-217-00AE8EF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-229-00AED6EB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-229-00AED6EB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-230-00AEC9E1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-230-00AEC9E1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-234-00AE9FFA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-234-00AE9FFA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-237-00AECCFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-237-00AECCFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-281-00AEB181 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-281-00AEB181 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-284-00AEB2E2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-284-00AEB2E2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-285-00AEB231 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-285-00AEB231 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-303-00AEA98D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-303-00AEA98D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-306-00AED9E6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-306-00AED9E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-307-00AED4B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-307-00AED4B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-308-00AED16B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-308-00AED16B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-310-00AECF9F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-310-00AECF9F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-311-00AECE5F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-311-00AECE5F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-325-00AEBDC6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-325-00AEBDC6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-331-00AE99A8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-331-00AE99A8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-333-00AE2642 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-333-00AE2642 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007100-36883-337-00AEF203 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007100-36883-337-00AEF203 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007100-36883-337-00AEF203 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007100-36883-337-00AEF203 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007100-36883-337-00AEF203 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00007100-36883-337-00AEF203 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-339-00AE8750 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-339-00AE8750 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-341-00AE66A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-341-00AE66A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007100-36883-347-00AE35D8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007100-36883-347-00AE35D8 Assembly shows XOR instruction xor byte ptr [edi-7AF07500h] ch in Stream UID: 00000000-00007100-36883-427-00AE843A30:T8cab,Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 176949; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 266376; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 433806; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 499031; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 679508; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 907562; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 949891; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 976164; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1029823; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1087005; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1089891; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1110627; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1183238; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1239420; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1264155; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1286672; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1320492; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1343465; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1358074; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1681487; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1686582; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 31396; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 36126; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 546851; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 597533; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 603521; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 633594; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 691192; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 772579; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 809914; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 882492; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 933919; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 979224; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1037518; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1053543; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1068790; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1134610; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1173843; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1298794; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1332931; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1409792; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1431745; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1558559; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1571991; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1608201; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1616999; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1679023; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1690745; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 51183; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 164417; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 247120; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 443512; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 463401; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 473899; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 488217; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 563970; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 576297; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 583902; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 611904; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 660388; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 720592; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 968213; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 988622; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 990013; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1057912; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1144872; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1193141; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1374128; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1381829; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1683118; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1684210; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_eca71a8195ce" at offset 1691174; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 176949; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 266376; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 433806; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 499031; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 679508; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 907562; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 949891; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 976164; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1029823; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1087005; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1089891; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1110627; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1183238; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1239420; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1264155; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1286672; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1320492; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1343465; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1358074; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1681487; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1686582; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 31396; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 36126; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 546851; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 597533; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 603521; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 633594; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 691192; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 772579; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 809914; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 882492; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 933919; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 979224; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1037518; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1053543; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1068790; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1134610; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1173843; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1298794; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1332931; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1409792; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1431745; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1558559; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1571991; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1608201; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1616999; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1679023; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1690745; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 51183; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 164417; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 247120; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 443512; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 463401; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 473899; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 488217; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 563970; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 576297; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 583902; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 611904; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 660388; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 720592; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 968213; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 988622; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 990013; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1057912; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1144872; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1193141; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1374128; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1381829; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1683118; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1684210; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_2d004296fcc8" at offset 1691174; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1466340; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 500966; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 501128; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 824286; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 824305; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 178338; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 178674; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 181338; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 183090; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 185148; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 187581; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 190786; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 192578; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 206434; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 218954; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 223793; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 225458; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 269175; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 313268; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 358270; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 389922; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 396098; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 399482; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 400706; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 401186; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 405778; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 431786; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 436485; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1518464; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1567757; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1593306; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1593606; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1603060; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1614940; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1624764; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1628385; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1629252; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 1635215; code bytes = 8030 Found XOR loop in file "NetPeerDistCim.dll" at offset 1116192; code bytes = 30d0 Found XOR loop in file "NetPeerDistCim.dll" at offset 1116264; code bytes = 30d0 Found XOR loop in file "NetPeerDistCim.dll" at offset 1119368; code bytes = 30d0 Found XOR loop in file "NetPeerDistCim.dll" at offset 1191466; code bytes = 30d0 Found XOR loop in file "NetPeerDistCim.dll" at offset 1501884; code bytes = 30d0 Found XOR loop in file "NetPeerDistCim.dll" at offset 109951; code bytes = 33c1 Found XOR loop in file "NetPeerDistCim.dll" at offset 676921; code bytes = 33c1 Found XOR loop in file "NetPeerDistCim.dll" at offset 807993; code bytes = 33c1 Found XOR loop in file "NetPeerDistCim.dll" at offset 1038043; code bytes = 33c1 Found XOR loop in file "NetPeerDistCim.dll" at offset 210993; code bytes = 8030 Found XOR loop in file "NetPeerDistCim.dll" at offset 1191854; code bytes = 8030 Found XOR loop in file "NetPeerDistCim.dll" at offset 1416824; code bytes = 8030 Found XOR loop in file "NetPeerDistCim.dll" at offset 1482368; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 874652; code bytes = 30d0 Found XOR loop in file "vulkan-1-32.dll" at offset 1366967; code bytes = 30d0 Found XOR loop in file "vulkan-1-32.dll" at offset 1378755; code bytes = 30d0 Found XOR loop in file "vulkan-1-32.dll" at offset 1380071; code bytes = 30d0 Found XOR loop in file "vulkan-1-32.dll" at offset 1388869; code bytes = 30d0 Found XOR loop in file "vulkan-1-32.dll" at offset 1390503; code bytes = 30d0 Found XOR loop in file "vulkan-1-32.dll" at offset 1390867; code bytes = 30d0 Found XOR loop in file "vulkan-1-32.dll" at offset 550148; code bytes = 33c1 Found XOR loop in file "vulkan-1-32.dll" at offset 598378; code bytes = 33c1 Found XOR loop in file "vulkan-1-32.dll" at offset 749316; code bytes = 33c1 Found XOR loop in file "vulkan-1-32.dll" at offset 1373097; code bytes = 33c1 Found XOR loop in file "vulkan-1-32.dll" at offset 391983; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1376320; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1378716; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1380032; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1387658; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1399770; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1400070; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1421404; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1431228; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1435716; code bytes = 8030 Found XOR loop in file "vulkan-1-32.dll" at offset 1441679; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 368127; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 390820; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 407629; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 431306; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 476019; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 1199858; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 1216667; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 1240344; code bytes = 30d0 Found XOR loop in file "TikTok Installer.exe" at offset 427420; code bytes = 33c1 Found XOR loop in file "TikTok Installer.exe" at offset 509687; code bytes = 33c1 Found XOR loop in file "TikTok Installer.exe" at offset 528500; code bytes = 33c1 Found XOR loop in file "TikTok Installer.exe" at offset 1236458; code bytes = 33c1 Found XOR loop in file "TikTok Installer.exe" at offset 43157; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 63137; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 118321; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 171270; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 359092; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 410266; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 424504; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 507172; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 510526; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 527416; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 1219304; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 1233542; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 1288858; code bytes = 8030 Found XOR loop in file "TikTok Installer.exe" at offset 1290543; code bytes = 8030 Found XOR loop in file "gdi32full.dll" at offset 33706; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 33732; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 33755; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 33777; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 36254; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 42025; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 127916; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 127922; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 140558; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 143396; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 150329; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 184486; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 184541; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 184591; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 184652; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 201036; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 263332; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 297047; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 297077; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 297101; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 297118; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 297141; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 297164; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 297178; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 532135; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 538665; code bytes = 33c1 Found XOR loop in file "gdi32full.dll" at offset 728926; code bytes = 8030 Found XOR loop in file "gdi32full.dll" at offset 953792; code bytes = 8030 Found XOR loop in file "gdi32full.dll" at offset 1127250; code bytes = 8030 Found XOR loop in file "gdi32full.dll" at offset 1128935; code bytes = 8030 Found XOR loop in file "SettingSyncCore.dll" at offset 172494; code bytes = 33c1 Found XOR loop in file "SettingSyncCore.dll" at offset 338544; code bytes = 33c1 Found XOR loop in file "SettingSyncCore.dll" at offset 377795; code bytes = 33c1 Found XOR loop in file "SettingSyncCore.dll" at offset 680730; code bytes = 33c1 Found XOR loop in file "SettingSyncCore.dll" at offset 1013180; code bytes = 30040e Found XOR loop in file "SettingSyncCore.dll" at offset 1052691; code bytes = 8030 Found XOR loop in file "SettingSyncCore.dll" at offset 1052695; code bytes = 8030 Found XOR loop in file "WpdMtpDr.dll" at offset 802616; code bytes = 30d0 Found XOR loop in file "WpdMtpDr.dll" at offset 896512; code bytes = 30d0 Found XOR loop in file "WpdMtpDr.dll" at offset 686939; code bytes = 33c1 Found XOR loop in file "WpdMtpDr.dll" at offset 855664; code bytes = 33c1 Found XOR loop in file "WpdMtpDr.dll" at offset 149129; code bytes = 8030 Found XOR loop in file "WpdMtpDr.dll" at offset 179689; code bytes = 8030 Found XOR loop in file "WpdMtpDr.dll" at offset 180877; code bytes = 8030 Found XOR loop in file "WpdMtpDr.dll" at offset 241868; code bytes = 8030 Found XOR loop in file "WpdMtpDr.dll" at offset 467155; code bytes = 8030 Found XOR loop in file "WpdMtpDr.dll" at offset 899592; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 221415; code bytes = 30d0 Found XOR loop in file "odbc32.dll" at offset 389636; code bytes = 30d0 Found XOR loop in file "odbc32.dll" at offset 733172; code bytes = 30d0 Found XOR loop in file "odbc32.dll" at offset 63963; code bytes = 33c1 Found XOR loop in file "odbc32.dll" at offset 66188; code bytes = 33c1 Found XOR loop in file "odbc32.dll" at offset 66458; code bytes = 33c1 Found XOR loop in file "odbc32.dll" at offset 238156; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 314686; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 348091; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 466230; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 471669; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 471832; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 472023; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 487615; code bytes = 8030 Found XOR loop in file "odbc32.dll" at offset 730832; code bytes = 8030 Found XOR loop in file "internetmail.dll" at offset 572016; code bytes = 30d0 Found XOR loop in file "internetmail.dll" at offset 572544; code bytes = 30d0 Found XOR loop in file "internetmail.dll" at offset 583349; code bytes = 30d0 Found XOR loop in file "internetmail.dll" at offset 697332; code bytes = 30d0 Found XOR loop in file "internetmail.dll" at offset 219830; code bytes = 33c1 Found XOR loop in file "internetmail.dll" at offset 563867; code bytes = 33c1 Found XOR loop in file "internetmail.dll" at offset 554721; code bytes = 8030 Found XOR loop in file "internetmail.dll" at offset 554767; code bytes = 8030 Found XOR loop in file "internetmail.dll" at offset 581974; code bytes = 8030 Found XOR loop in file "internetmail.dll" at offset 688428; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 318520; code bytes = 30d0 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 29592; code bytes = 33c1 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 239478; code bytes = 33c1 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 239484; code bytes = 33c1 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 6318; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 12944; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 15208; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 15248; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 349796; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 429720; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 444972; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 466394; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 466694; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 488028; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 497852; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 502337; code bytes = 8030 Found XOR loop in file "Intel_OpenCL_ICD64.dll" at offset 508299; code bytes = 8030 Found XOR loop in file "Windows.Gaming.XboxLive.Storage.dll" at offset 222059; code bytes = 33c1 Found XOR loop in file "Windows.Gaming.XboxLive.Storage.dll" at offset 273096; code bytes = 8030 Found XOR loop in file "Windows.Gaming.XboxLive.Storage.dll" at offset 322242; code bytes = 8030 Found XOR loop in file "mdmregistration.dll" at offset 36005; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 36216; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 36332; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 36447; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 68645; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 68829; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 75268; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 80246; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 80305; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 80335; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 80387; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 80442; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 84554; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 89820; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 89874; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 89908; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 89953; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 90002; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 90202; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 90242; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 234063; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 234282; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 234392; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 234508; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 247267; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 247370; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 247428; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 252699; code bytes = 33c1 Found XOR loop in file "mdmregistration.dll" at offset 61452; code bytes = 8030 Found XOR loop in file "mdmregistration.dll" at offset 100560; code bytes = 8030 Found XOR loop in file "mdmregistration.dll" at offset 127344; code bytes = 8030 Found XOR loop in file "mdmregistration.dll" at offset 164784; code bytes = 8030 Found XOR loop in file "mdmregistration.dll" at offset 396616; code bytes = 8030 Found XOR loop in file "igfxDIN.dll" at offset 334852; code bytes = 30d0 Found XOR loop in file "igfxDIN.dll" at offset 137040; code bytes = 33c1 Found XOR loop in file "igfxDIN.dll" at offset 173182; code bytes = 33c1 Found XOR loop in file "igfxDIN.dll" at offset 173201; code bytes = 33c1 Found XOR loop in file "igfxDIN.dll" at offset 370650; code bytes = 8030 Found XOR loop in file "igfxDIN.dll" at offset 370950; code bytes = 8030 Found XOR loop in file "igfxDIN.dll" at offset 392285; code bytes = 8030 Found XOR loop in file "igfxDIN.dll" at offset 402109; code bytes = 8030 Found XOR loop in file "igfxDIN.dll" at offset 406594; code bytes = 8030 Found XOR loop in file "igfxDIN.dll" at offset 412194; code bytes = 8030 Found XOR loop in file "igfxDIN.dll" at offset 412557; code bytes = 8030 Found XOR loop in file "es.dll" at offset 125195; code bytes = 33c1 Found XOR loop in file "es.dll" at offset 269816; code bytes = 8030 Found XOR loop in file "es.dll" at offset 400203; code bytes = 8030 Found XOR loop in file "pdh.dll" at offset 13060; code bytes = 33c1 Found XOR loop in file "pdh.dll" at offset 70473; code bytes = 33c1 Found XOR loop in file "pdh.dll" at offset 301624; code bytes = 8030 Found XOR loop in file "smartscreenps.dll" at offset 70998; code bytes = 33c1 Found XOR loop in file "smartscreenps.dll" at offset 151764; code bytes = 33c1 Found XOR loop in file "smartscreenps.dll" at offset 278723; code bytes = 8030 Found XOR loop in file "smartscreenps.dll" at offset 302332; code bytes = 8030 Found XOR loop in file "wdsutil.dll" at offset 208467; code bytes = 30d0 Found XOR loop in file "wdsutil.dll" at offset 278200; code bytes = 30d0 Found XOR loop in file "wdsutil.dll" at offset 187835; code bytes = 33c1 Found XOR loop in file "wdsutil.dll" at offset 200464; code bytes = 8030 Found XOR loop in file "wdsutil.dll" at offset 207227; code bytes = 8030 Found XOR loop in file "wdsutil.dll" at offset 254292; code bytes = 8030 Found XOR loop in file "wdsutil.dll" at offset 300540; code bytes = 8030 Found XOR loop in file "wdsutil.dll" at offset 301931; code bytes = 8030 Found XOR loop in file "wdsutil.dll" at offset 302225; code bytes = 8030 Found XOR loop in file "directxdatabaseupdater.exe" at offset 277204; code bytes = 30d0 Found XOR loop in file "directxdatabaseupdater.exe" at offset 76795; code bytes = 33c1 Found XOR loop in file "directxdatabaseupdater.exe" at offset 98449; code bytes = 33c1 Found XOR loop in file "directxdatabaseupdater.exe" at offset 98635; code bytes = 33c1 Found XOR loop in file "directxdatabaseupdater.exe" at offset 206860; code bytes = 33c1 Found XOR loop in file "DAFWSD.dll" at offset 283532; code bytes = 30d0 Found XOR loop in file "DAFWSD.dll" at offset 301292; code bytes = 30d0 Found XOR loop in file "DAFWSD.dll" at offset 84697; code bytes = 33c1 Found XOR loop in file "DAFWSD.dll" at offset 84881; code bytes = 33c1 Found XOR loop in file "DAFWSD.dll" at offset 248331; code bytes = 33c1 Found XOR loop in file "TtlsAuth.dll" at offset 63168; code bytes = 33c1 Found XOR loop in file "TtlsAuth.dll" at offset 202507; code bytes = 33c1 Found XOR loop in file "PresentationHost.exe" at offset 62843; code bytes = 33c1 Found XOR loop in file "PresentationHost.exe" at offset 200960; code bytes = 33c1 Found XOR loop in file "PresentationHost.exe" at offset 188552; code bytes = 8030 Found XOR loop in file "PresentationHost.exe" at offset 193488; code bytes = 8030 Found XOR loop in file "JHI.dll" at offset 167244; code bytes = 30d0 Found XOR loop in file "JHI.dll" at offset 176396; code bytes = 30d0 Found XOR loop in file "JHI.dll" at offset 201508; code bytes = 30d0 Found XOR loop in file "JHI.dll" at offset 249983; code bytes = 30d0 Found XOR loop in file "JHI.dll" at offset 253019; code bytes = 30d0 Found XOR loop in file "JHI.dll" at offset 261184; code bytes = 30d0 Found XOR loop in file "JHI.dll" at offset 47092; code bytes = 33c1 Found XOR loop in file "JHI.dll" at offset 52100; code bytes = 33c1 Found XOR loop in file "JHI.dll" at offset 52229; code bytes = 33c1 Found XOR loop in file "JHI.dll" at offset 267990; code bytes = 33c1 Found XOR loop in file "JHI.dll" at offset 204444; code bytes = 8030 Found XOR loop in file "JHI.dll" at offset 216794; code bytes = 8030 Found XOR loop in file "JHI.dll" at offset 245200; code bytes = 8030 Found XOR loop in file "JHI.dll" at offset 248070; code bytes = 8030 Found XOR loop in file "JHI.dll" at offset 249964; code bytes = 8030 Found XOR loop in file "JHI.dll" at offset 253470; code bytes = 8030 Found XOR loop in file "JHI.dll" at offset 257910; code bytes = 8030 Found XOR loop in file "psmsrv.dll" at offset 71057; code bytes = 30d0 Found XOR loop in file "psmsrv.dll" at offset 85339; code bytes = 33c131:T4ca,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "PresentationHost.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "JHI.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "msdtcstp.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "netfxperf.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "WinMgmt.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "GameInputSvc.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "nsExec.dll") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp")32:T492,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "postmessage"; File: "PresentationHost.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "tcpmonui.dll") file/memory contains long string with (Indicator: "enumwindows"; File: "GameInputSvc.exe") file/memory contains long string with (Indicator: "postmessage"; File: "wsmprovhost.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "Apphlpdm.dll") file/memory contains long string with (Indicator: "postmessage"; File: "GamePanelExternalHook.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsExec.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004248-00000C2C-3267969352") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00004248-00000C2C-3267969389")33:T2a50,"Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000f0116e17174c0ed0f01b8ed0f01c4ed0f010200000080f62e77d0ed0f01aaec71740200000000000000e447dd72b6ec7174e86e233d08ee0f017de0717464e07174306d233de447dd7205000000f09ddd720000000075e2dd7286e2dd7288ee0f01802b747458c55248feffffff14ee0f01e0df71742002df7224ee0f0149d9de72c064e1722002df7230ee0f0163d9de722002df7254ee0f01fa9ddd72010000000100000037067e77010000000b2e727406000000dad8de7298ee0f01eecfde72c4dcde72e2cfde726e0065a801000000010000000000000006f86f251800000094ee0f0132ba8077a068e172000000000000000000000000a8ee0f01 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000090c90f0138cf7f77b4362c03fcc90f010100000068362c03b4362c0368362c03040000000400000000e0397700100000fcc90f010100000068362c03cd977f779c977f775eda6f25b50f307768362c0300007f7700000000fc182a760000000080ee36770100000008cb0f01f8e2397700000000040000000000000048403877f8e2397700ca0f0180e8d37610a82c0380e8d376fcc90f010000000080e8d37628ca0f011b800800a0ca0f01580600002cd10f01642af57366b4931f01000000faffffffd8d10f01000000001800000000000000841722740000000000000000ffffffff0000000000000000000000005e9d2e03749d2e03 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002cd10f01a0ca0f011b8008008b47f0000802000000000000000000000000000090ca0f011b80080008cb0f015806000094d10f01180000008417227408020000000000006248f0720802000000000000000000000000000090ca0f0100000000000000001800000094d10f0108cb0f013c1422742cc90f010802000040ca0f01a2e0f1721432df07feffffff50ca0f01222af5730802000000000000000000000000000028ca0f011b800800a0ca0f01580600002cd10f01642af57366b4931f01000000faffffffd8d10f01000000001800000000000000841722740000000000000000ffffffff0000000000000000000000008ed52e03a6d52e03 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002cd10f01a0ca0f011b8008008b47f0000802000000000000000000000000000090ca0f011b80080008cb0f015806000094d10f01180000008417227408020000000000006248f0720802000000000000000000000000000090ca0f0100000000000000001800000094d10f0108cb0f013c1422742cc90f010802000040ca0f01a2e0f1721432df07feffffff50ca0f01222af5730802000000000000000000000000000028ca0f011b800800a0ca0f01580600002cd10f01642af57366b4931f01000000faffffffd8d10f01000000001800000000000000841722740000000000000000ffffffff0000000000000000000000008ed52e03a2d52e03 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002cd10f01a0ca0f011b8008008b47f0000802000000000000000000000000000090ca0f011b80080008cb0f015806000094d10f01180000008417227408020000000000006248f0720802000000000000000000000000000090ca0f0100000000000000001800000094d10f0108cb0f013c1422742cc90f010802000040ca0f01a2e0f1721432df07feffffff50ca0f01222af5730802000000000000000000000000000028ca0f011b800800a0ca0f01580600002cd10f01642af57366b4931f01000000faffffffd8d10f01000000001800000000000000841722740000000000000000ffffffff000000000000000000000000665f2e037e5f2e03 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002cd10f01a0ca0f011b8008008b47f0000802000000000000000000000000000090ca0f011b80080008cb0f015806000094d10f01180000008417227408020000000000006248f0720802000000000000000000000000000090ca0f0100000000000000001800000094d10f0108cb0f013c1422742cc90f010802000040ca0f01a2e0f1721432df07feffffff50ca0f01222af5730802000000000000000000000000000028ca0f011b800800a0ca0f01580600002cd10f01642af57366b4931f01000000faffffffd8d10f01000000001800000000000000841722740000000000000000ffffffff000000000000000000000000665f2e037c5f2e03 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002cd10f01a0ca0f011b8008008b47f0000802000000000000000000000000000090ca0f011b80080008cb0f015806000094d10f01180000008417227408020000000000006248f0720802000000000000000000000000000090ca0f0100000000000000001800000094d10f0108cb0f013c1422742cc90f010802000040ca0f01a2e0f1721432df07feffffff50ca0f01222af5730802000000000000000000000000000028ca0f011b800800a0ca0f01580600002cd10f01642af57366b4931f01000000faffffffd8d10f01000000001800000000000000841722740000000000000000ffffffff0000000000000000000000009e132f03b6132f03 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000f0148bbea04c000ea04c06f3d7350bbea04c8ef0f01b0ef0f01d06f3d736cbbea04a74d3d730000000050bbea04b74d3d73106322c24ebc40730000000070012f0304f00f01e4ef0f01c06f3d7350bbea041cf00f0100000000000000006cbbea04a74d3d73000000008c583d7700000000506322c270f00f0152e66f2548bbea040240008050f00f01506a827722e3ea53feffffff60f00f0100164d7778b22d0354b04c7323877f77e1867f7722e66f25000000008c583d7748bbea040000000078b22d030400000000164d7728f00f0148bbea04b04d48779d8a25c10000000070012f0348bbea0413e63f73000037732c534c7354f00f0180ee3677 (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005580) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002008) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002008) "tasklist.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007100) "tasklist.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007100) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000312) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000312)34:T5ce,"Drv_ceo_12.8.1_x64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Drv_ceo_12.8.1_x64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "ev2f79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ev2c34.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")35:T483,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "GetVersion"; File: "nsExec.dll") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")36:T15b1,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00004248-00000C17-3265727479 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00004248-00000C17-3266154332 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004248-00000C17-3268905229 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00004248-00000C17-3269313463 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00004248-00000C17-3269470436 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00004248-00000C17-3269556411 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004248-00000C17-3269653457 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004248-00000C17-3269730732 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004248-00000C17-3269730956 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00004248-00000C17-3270617361 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004248-00000C17-3270758758 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004248-00000C17-3270771272 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004248-00000C17-3270771510 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004248-00000C17-3271802640 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004248-00000C17-3274166095 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004248-00000C17-3274732108 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004248-00000C17-3275305713 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004248-00000C17-3275496628 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004248-00000C17-3275565310 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00004248-00000C17-3275678995 "powershell.exe" queries volume information of "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00004248-00000C17-3275790163 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00004248-00000C17-3275980425 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00004248-00000C17-3275994185 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00004248-00000C17-3275994459 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004248-00000C17-327614633937:T450,"Drv_ceo_12.8.1_x64.exe" called "CreateProcessA" with parameter "cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" - (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "CreateProcessA" with parameter "cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" - (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "CreateProcessA" with parameter ""%APPDATA%\comain_ev2f79\ev2f79.exe"" - (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "CreateProcessA" with parameter ""%APPDATA%\comain_ev2c34\ev2c34.exe"" - (UID: 00000000-00005580) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00002008) "cmd.exe" called "CreateProcessW" with parameter "findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" - (UID: 00000000-00002008) "cmd.exe" called "CreateProcessW" with parameter "cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" - (UID: 00000000-00000312) "cmd.exe" called "CreateProcessW" with parameter "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" - (UID: 00000000-00002280)38:T3e78,"Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %TEMP%\nsmE384.tmp\nsExec.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter %TEMP%\nsmE384.tmp\System.dll (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "LoadLibrary" with a parameter bcrypt (UID: 00000000-00005580) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00007100) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004248) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004248) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002196) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002196) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004324) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004324)39:Td852,"Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter ExecToStack (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter Exec (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter Store (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter Alloc (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter Int64Op (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00005580) "Drv_ceo_12.8.1_x64.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00005580) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002008) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002008) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002008) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002008) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002008) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002008) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002008) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002008) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00007100) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007100) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000312) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002280) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002280) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00004248) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00004248) "ev2f79.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter ZwSetInformationFile (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter NtCreateSection (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter NtMapViewOfSection (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00002196) "ev2f79.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002196) "ev2c34.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter ZwSetInformationFile (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter NtCreateSection (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter NtMapViewOfSection (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00004324) "ev2c34.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00004324)3a:T43d,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "CreateFile"; File: "nsExec.dll") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp")3b:Tdfc2,Found reference to API (Indicator: "MulDiv"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "DeleteFileA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "FindNextFileA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "FindClose"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GlobalFree"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "lstrcmpA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CloseHandle"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetFileTime"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SearchPathA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "MoveFileA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "Sleep"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetTickCount"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CreateFileA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetFileSize"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ReadFile"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CopyFileA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ExitProcess"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetTempPathA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "lstrlenA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetVersion"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "lstrcpynA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GlobalLock"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CreateThread"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetLastError"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CreateProcessA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "WriteFile"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "lstrcpyA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "MoveFileExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "lstrcatA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "DrawTextA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "FillRect"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetClientRect"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "BeginPaint"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SendMessageA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "EnableWindow"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetDC"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "LoadImageA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "IsWindow"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "FindWindowExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SendMessageTimeoutA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "wsprintfA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ShowWindow"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetTimer"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CharNextA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegisterClassA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetClassLongA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetSysColor"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetCursor"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "LoadCursorA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "AppendMenuA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CharPrevA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "PeekMessageA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SelectObject"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "DeleteObject"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SHFileOperationA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SHGetFileInfoA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "ShellExecuteExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetFileSecurityA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "OleInitialize"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API (Indicator: "WinStationFreeMemory"; File: "00000000-00007100.00000000.272518.00AE1000.00000020.mdmp") Found reference to API (Indicator: "WinStationCloseServer"; File: "00000000-00007100.00000000.272518.00AE1000.00000020.mdmp") Found reference to API (Indicator: "WinStationOpenServerW"; File: "00000000-00007100.00000000.272518.00AE1000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; File: "00000000-00007100.00000000.272518.00AE1000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SHCreateStreamOnFileEx"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "StrCmpIW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "PathAppendW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "StartServiceA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp, 00000000-00004248.00000001.274074.6F501000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp, 00000000-00004248.00000001.274074.6F501000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp, 00000000-00004248.00000001.274074.6F501000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004248.00000000.272896.05330000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp")3c:T430,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "GetLastError"; File: "System.dll") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")3d:Tf63,"Software\Microsoft\Windows\CurrentVersion" in Source: Drv_ceo_12.8.1_x64.exe "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 44784-159-00C5D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 44784-194-00C58190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 44784-194-00C58190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 44784-194-00C58190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 44784-196-00C5BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 44784-207-00C58AF0 "SOFTWARE\Microsoft\EdgeUpdate" in Source: 45183-524-00A141CD "Software\OEM\MicrosoftEdge" in Source: 45183-524-00A141CD "Software\OEM\MicrosoftEdge" in Source: 00000000-00002196.00000000.273033.00A2C000.00000002.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00002196.00000000.273033.00A2C000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004248.00000000.272896.03300000.00000004.mdmp 00000000-00004248.00000001.274074.03320000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004248.00000000.272896.03300000.00000004.mdmp 00000000-00004248.00000001.274074.03320000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00004248.00000000.272896.07C02000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp3e:T6c1,Process Drv_ceo_12.8.1_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5580:168:WilStaging_02" Process Drv_ceo_12.8.1_x64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5580:64:WilError_01" Process Drv_ceo_12.8.1_x64.exe created mutex with name "Local\SM0:5580:168:WilStaging_02" Process Drv_ceo_12.8.1_x64.exe created mutex with name "SM0:5580:64:WilError_01" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7100:168:WilStaging_02" Process tasklist.exe created mutex with name "SM0:7100:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4248:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4248:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4248:64:WilError_01" Process powershell.exe created mutex with name "Local\SM0:4248:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:4248:64:WilError_01" Process powershell.exe created mutex with name "Local\SM0:4248:64:WilError_01" Process powershell.exe created mutex with name "SM0:4248:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4248:168:WilStaging_02"3f:T96f,Antivirus vendors marked dropped file "vulkan-1.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 13 sections"), Antivirus vendors marked dropped file "NetPeerDistCim.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "vulkan-1-32.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"), Antivirus vendors marked dropped file "TikTok Installer.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "gdi32full.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "SettingSyncCore.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "WpdMtpDr.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "odbc32.dll" as clean (type is "PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "Intel_OpenCL_ICD64.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "Windows.Gaming.XboxLive.Storage.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "mdmregistration.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "igfxDIN.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "es.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "pdh.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "smartscreenps.dll" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "wdsutil.dll" as clean (type is "PE32+ executable for MS Windows 6.01 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "directxdatabaseupdater.exe" as clean (type is "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections")40:T1280,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]41:T1071,"Drv_ceo_12.8.1_x64.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ev2f79.exe.nhpart_eca71a8195ce" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ev2c34.exe.nhpart_2d004296fcc8" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vulkan-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "NetPeerDistCim.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vulkan-1-32.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "TikTok Installer.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "gdi32full.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "SettingSyncCore.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "WpdMtpDr.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "odbc32.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "internetmail.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Intel_OpenCL_ICD64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "Windows.Gaming.XboxLive.Storage.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "mdmregistration.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "igfxDIN.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "es.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "pdh.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "smartscreenps.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "wdsutil.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "directxdatabaseupdater.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DAFWSD.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF42:T1306,"SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00002196.00000000.273033.00A2C000.00000002.mdmp "Software\OEM\MicrosoftEdge" in Source: 00000000-00002196.00000000.273033.00A2C000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004248.00000000.272896.00C51000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004248.00000000.272896.03300000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004248.00000000.272896.03300000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004248.00000000.272896.05330000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00004248.00000000.272896.07C02000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004248.00000001.274074.03320000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004248.00000001.274074.08E61000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004248.00000001.274074.08E61000.00000004.mdmp "SOFTWARE\Microsoft\EdgeUpdate" in Source: 00000000-00004324.00000000.273209.013AC000.00000002.mdmp "Software\OEM\MicrosoftEdge" in Source: 00000000-00004324.00000000.273209.013AC000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005580.00000000.272414.00408000.00000002.mdmp "Software\MicrosoftUserAdmin" in Source: 00000000-00005580.00000000.272414.032C0000.00000004.mdmp "Software\MicrosoftUserAdmin" in Source: 00000000-00005580.00000001.273227.032E3000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007100.00000000.272518.03330000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00007100.00000000.272518.04CD0000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00007100.00000000.272518.04CD0000.00000002.mdmp43:T2dc7,"Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e60000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 72e30000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 74cf0000 "Drv_ceo_12.8.1_x64.exe" loaded module "NTDLL.DLL" at base 777b0000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74120000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 737c0000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72ff0000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 741c0000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72dd0000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 74a00000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73f40000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72dc0000 "Drv_ceo_12.8.1_x64.exe" loaded module "KERNEL32.DLL" at base 74c00000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 73360000 "Drv_ceo_12.8.1_x64.exe" loaded module "%TEMP%\NSME384.TMP\NSEXEC.DLL" at base 72db0000 "Drv_ceo_12.8.1_x64.exe" loaded module "%TEMP%\NSME384.TMP\SYSTEM.DLL" at base 72db0000 "Drv_ceo_12.8.1_x64.exe" loaded module "BCRYPT" at base 73150000 "Drv_ceo_12.8.1_x64.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76b80000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e60000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74c00000 "cmd.exe" loaded module "NTDLL.DLL" at base 777b0000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e60000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 741f0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 771f0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72bb0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 731d0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72b30000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72a70000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 771f0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 771f0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72a50000 "tasklist.exe" loaded module "NTDLL.DLL" at base 777b0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e60000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 742c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72ca0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 754e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 749f0000 "powershell.exe" loaded module "VERSION.DLL" at base 73f40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 724f0000 "powershell.exe" loaded module "USER32.DLL" at base 74570000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 771f0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 72d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 773d0000 "powershell.exe" loaded module "PSAPI.DLL" at base 77780000 "powershell.exe" loaded module "RPCRT4.DLL" at base 741f0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71010000 "powershell.exe" loaded module "OLE32.DLL" at base 77620000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 773d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 74840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76b80000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 771f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 704f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fcd0000 "powershell.exe" loaded module "COMBASE.DLL" at base 773d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 773d0000 "powershell.exe" loaded module "NTDLL.DLL" at base 777b0000 "powershell.exe" loaded module "SHELL32.DLL" at base 75690000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75530000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75530000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74340000 "powershell.exe" loaded module "AMSI.DLL" at base 6fca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f520000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73f40000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f500000 "powershell.exe" loaded module "CRYPT32.DLL" at base 74340000 "powershell.exe" loaded module "KERNEL32" at base 74c00000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MF9FIBW6.DLL" at base 6f4c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f440000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f0e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 773d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6ef80000 "powershell.exe" loaded module "SECUR32.DLL" at base 6ef70000 "powershell.exe" loaded module "SSPICLI.DLL" at base 741d0000 "powershell.exe" loaded module "WLDP.DLL" at base 6ef20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ee80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74c00000 "powershell.exe" loaded module "USERENV.DLL" at base 72e30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 742c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 72fc0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 72fa0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74c00000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 72f70000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 72f60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72e00000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 72e00000 "powershell.exe" loaded module "URLMON.DLL" at base 73b60000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 771f0000 "powershell.exe" loaded module "MSISO.DLL" at base 6ec80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6ebd0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 73150000 "powershell.exe" loaded module "OLEAUT32" at base 74840000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 771f0000 "powershell.exe" loaded module "MSVCRT.DLL" at base 755d0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 72f40000 "powershell.exe" loaded module "MI.DLL" at base 72de0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 771f0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 72db0000 "powershell.exe" loaded module "GDI32.DLL" at base 749c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 771f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ef50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ef40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e770000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 771f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 771f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 74c00000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 771f0000 "ev2f79.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e60000 "ev2f79.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "ev2f79.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "ev2f79.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "ev2f79.exe" loaded module "KERNEL32" at base 74c00000 "ev2f79.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "ev2f79.exe" loaded module "SHLWAPI.DLL" at base 754e0000 "ev2f79.exe" loaded module "USER32" at base 74570000 "ev2f79.exe" loaded module "KERNEL32.DLL" at base 74c00000 "ev2f79.exe" loaded module "ADVAPI32.DLL" at base 742c0000 "ev2f79.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 771f0000 "ev2f79.exe" loaded module "RPCRT4.DLL" at base 741f0000 "ev2f79.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 749f0000 "ev2c34.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e60000 "ev2c34.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "ev2c34.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "ev2c34.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "ev2c34.exe" loaded module "KERNEL32" at base 74c00000 "ev2c34.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "ev2c34.exe" loaded module "SHLWAPI.DLL" at base 754e0000 "ev2c34.exe" loaded module "USER32" at base 74570000 "ev2c34.exe" loaded module "KERNEL32.DLL" at base 74c00000 "ev2c34.exe" loaded module "SHELL32.DLL" at base 75690000 "ev2c34.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 771f0000 "ev2c34.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 749f000044:Teea,"Drv_ceo_12.8.1_x64.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Drv_ceo_12.8.1_x64.exe" was detected as "Microsoft Linker" and name: "Linker" "ev2f79.exe.nhpart_eca71a8195ce" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ev2f79.exe.nhpart_eca71a8195ce" was detected as "Microsoft Linker" and name: "Linker" "ev2c34.exe.nhpart_2d004296fcc8" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ev2c34.exe.nhpart_2d004296fcc8" was detected as "Microsoft Linker" and name: "Linker" "vulkan-1.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "vulkan-1.dll" was detected as "Microsoft Linker" and name: "Linker" "NetPeerDistCim.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "NetPeerDistCim.dll" was detected as "Microsoft Linker" and name: "Linker" "vulkan-1-32.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "vulkan-1-32.dll" was detected as "Microsoft Linker" and name: "Linker" "TikTok Installer.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "TikTok Installer.exe" was detected as "Microsoft Linker" and name: "Linker" "gdi32full.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "gdi32full.dll" was detected as "Microsoft Linker" and name: "Linker" "SettingSyncCore.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SettingSyncCore.dll" was detected as "Microsoft Linker" and name: "Linker" "WpdMtpDr.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "WpdMtpDr.dll" was detected as "Microsoft Linker" and name: "Linker" "odbc32.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "odbc32.dll" was detected as "Microsoft Linker" and name: "Linker" "internetmail.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "internetmail.dll" was detected as "Microsoft Linker" and name: "Linker" "Intel_OpenCL_ICD64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Intel_OpenCL_ICD64.dll" was detected as "Microsoft Linker" and name: "Linker" "Windows.Gaming.XboxLive.Storage.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Windows.Gaming.XboxLive.Storage.dll" was detected as "Microsoft Linker" and name: "Linker" "mdmregistration.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "mdmregistration.dll" was detected as "Microsoft Linker" and name: "Linker" "igfxDIN.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "igfxDIN.dll" was detected as "Microsoft Linker" and name: "Linker" "es.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "es.dll" was detected as "Microsoft Linker" and name: "Linker" "pdh.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "pdh.dll" was detected as "Microsoft Linker" and name: "Linker" "smartscreenps.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "smartscreenps.dll" was detected as "Microsoft Linker" and name: "Linker" "wdsutil.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "wdsutil.dll" was detected as "Microsoft Linker" and name: "Linker" "directxdatabaseupdater.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "directxdatabaseupdater.exe" was detected as "Microsoft Linker" and name: "Linker" "DAFWSD.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "DAFWSD.dll" was detected as "Microsoft Linker" and name: "Linker"45:T805,"Drv_ceo_12.8.1_x64.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Drv_ceo_12.8.1_x64.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "Drv_ceo_12.8.1_x64.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")46:T44b,"Drv_ceo_12.8.1_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Drv_ceo_12.8.1_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Drv_ceo_12.8.1_x64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")47:Td57,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00005580-00000C2B-3256574684] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00005580-00000C2B-3256600859] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00005580-00000C2B-3256639209] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00005580-00000C2B-3256720138] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00005580-00000C2B-3256748528] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005580-00000C2B-3256773651] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005580-00000C2B-3256797304] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005580-00000C2B-3256825188] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005580-00000C2B-3256849380] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005580-00000C2B-3256874245] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005580-00000C2B-3256900004] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00007100-00000C2B-3258232302] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004248-00000C2E-892923990] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004248-00000C2B-3265113758] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004248-00000C2B-3265265347] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004248-00000C2B-3265333772] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004248-00000C2B-3265499500] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004248-00000C2B-3265522865] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004248-00000C2B-3265590971] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004248-00000C2B-3265673370] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004248-00000C2B-3265924959] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004248-00000C2B-3265951058] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004248-00000C2B-3266403652] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004248-00000C2B-3266434165] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004248-00000C2B-3266527115]48:T457c,"ev2f79.exe.nhpart_eca71a8195ce" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_eca71a8195ce]- [targetUID: 00000000-00005580] "ev2c34.exe.nhpart_2d004296fcc8" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_2d004296fcc8]- [targetUID: 00000000-00005580] "vulkan-1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 13 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1.dll]- [targetUID: 00000000-00005580] "NetPeerDistCim.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\NetPeerDistCim.dll]- [targetUID: 00000000-00005580] "vulkan-1-32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1-32.dll]- [targetUID: 00000000-00005580] "TikTok Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\Community\TikTok Installer.exe]- [targetUID: 00000000-00005580] "gdi32full.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\gdi32full.dll]- [targetUID: 00000000-00005580] "SettingSyncCore.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\SettingSyncCore.dll]- [targetUID: 00000000-00005580] "WpdMtpDr.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WpdMtpDr.dll]- [targetUID: 00000000-00005580] "odbc32.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\odbc32.dll]- [targetUID: 00000000-00005580] "internetmail.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\internetmail.dll]- [targetUID: 00000000-00005580] "Intel_OpenCL_ICD64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Intel_OpenCL_ICD64.dll]- [targetUID: 00000000-00005580] "Windows.Gaming.XboxLive.Storage.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Gaming.XboxLive.Storage.dll]- [targetUID: 00000000-00005580] "mdmregistration.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mdmregistration.dll]- [targetUID: 00000000-00005580] "igfxDIN.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\igfxDIN.dll]- [targetUID: 00000000-00005580] "es.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\es.dll]- [targetUID: 00000000-00005580] "pdh.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\pdh.dll]- [targetUID: 00000000-00005580] "smartscreenps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\smartscreenps.dll]- [targetUID: 00000000-00005580] "wdsutil.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wdsutil.dll]- [targetUID: 00000000-00005580] "directxdatabaseupdater.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\directxdatabaseupdater.exe]- [targetUID: 00000000-00005580] "DAFWSD.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\DAFWSD.dll]- [targetUID: 00000000-00005580] "TtlsAuth.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\TtlsAuth.dll]- [targetUID: 00000000-00005580] "PresentationHost.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\PresentationHost.exe]- [targetUID: 00000000-00005580] "JHI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\JHI.dll]- [targetUID: 00000000-00005580] "psmsrv.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\psmsrv.dll]- [targetUID: 00000000-00005580] "wermgr.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wermgr.exe]- [targetUID: 00000000-00005580] "Windows.Media.Streaming.ps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Media.Streaming.ps.dll]- [targetUID: 00000000-00005580] "RDCameraMediaSource.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\RDCameraMediaSource.dll]- [targetUID: 00000000-00005580] "W32UIRes.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\W32UIRes.dll]- [targetUID: 00000000-00005580] "ipmiprv.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\ipmiprv.dll]- [targetUID: 00000000-00005580] "EsclWiaDriver.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\EsclWiaDriver.dll]- [targetUID: 00000000-00005580] "fhshl.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\fhshl.dll]- [targetUID: 00000000-00005580] "msaudite.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msaudite.dll]- [targetUID: 00000000-00005580] "StorFwUpdate.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\StorFwUpdate.dll]- [targetUID: 00000000-00005580] "RjvPlatform.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\RjvPlatform.dll]- [targetUID: 00000000-00005580] "msdtcstp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msdtcstp.dll]- [targetUID: 00000000-00005580] "netfxperf.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\netfxperf.dll]- [targetUID: 00000000-00005580] "sethc.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\sethc.exe]- [targetUID: 00000000-00005580] "AppListBackupLauncher.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\AppListBackupLauncher.dll]- [targetUID: 00000000-00005580] "msoobewirelessplugin.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msoobewirelessplugin.dll]- [targetUID: 00000000-00005580] "MitigationConfiguration.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\MitigationConfiguration.dll]- [targetUID: 00000000-00005580] "WinMgmt.exe" has type "PE32+ executable for MS Windows 10.00 (console) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WinMgmt.exe]- [targetUID: 00000000-00005580] "TableTextServiceMig.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\TableTextServiceMig.dll]- [targetUID: 00000000-00005580] "tcpmonui.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\tcpmonui.dll]- [targetUID: 00000000-00005580] "mferror.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mferror.dll]- [targetUID: 00000000-00005580] "WlanRadioManager.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WlanRadioManager.dll]- [targetUID: 00000000-00005580] "kernel.appcore.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\kernel.appcore.dll]- [targetUID: 00000000-00005580] "tssysprep.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\tssysprep.dll]- [targetUID: 00000000-00005580] "GameInputSvc.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\GameInputSvc.exe]- [targetUID: 00000000-00005580] "wsmprovhost.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wsmprovhost.exe]- [targetUID: 00000000-00005580] "SyncInfrastructureps.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\SyncInfrastructureps.dll]- [targetUID: 00000000-00005580] "Apphlpdm.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Apphlpdm.dll]- [targetUID: 00000000-00005580] "fsutilext.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\fsutilext.dll]- [targetUID: 00000000-00005580] "GamePanelExternalHook.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\GamePanelExternalHook.dll]- [targetUID: 00000000-00005580] "shgina.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\shgina.dll]- [targetUID: 00000000-00005580] "DscTimer.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\DscTimer.dll]- [targetUID: 00000000-00005580] "dllhost.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\dllhost.exe]- [targetUID: 00000000-00005580] "LangCleanupSysprepAction.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\LangCleanupSysprepAction.dll]- [targetUID: 00000000-00005580] "coreaudiopolicymanagerext.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\coreaudiopolicymanagerext.dll]- [targetUID: 00000000-00005580] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsmE384.tmp\System.dll]- [targetUID: 00000000-00005580] "api-ms-win-core-stringloader-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\api-ms-win-core-stringloader-l1-1-1.dll]- [targetUID: 00000000-00005580] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsmE384.tmp\nsExec.dll]- [targetUID: 00000000-00005580] "powershell.exe.log" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00004248] "nshE316.tmp" has type "Unknown"- Location: [%TEMP%\nshE316.tmp]- [targetUID: 00000000-00005580] "nh_2d004296fcc8.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_2d004296fcc8.nhc]- [targetUID: 00000000-00005580] "nh_eca71a8195ce.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_eca71a8195ce.nhc]- [targetUID: 00000000-00005580] "adp80xx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\adp80xx.sys]- [targetUID: 00000000-00005580] "PCL5URES.DLL" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64"- Location: [%TEMP%\nsmE384.tmp\8e555392\PCL5URES.DLL]- [targetUID: 00000000-00005580] "iaStorAVC.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\iaStorAVC.sys]- [targetUID: 00000000-00005580] "nh_39f7b8fb60cd.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_39f7b8fb60cd.nhc]- [targetUID: 00000000-00005580] "yinma.vc.nhpart_39f7b8fb60cd" has type "Unknown"- Location: [%APPDATA%\comain_ev2f79\yinma.vc.nhpart_39f7b8fb60cd]- [targetUID: 00000000-00005580] "nh_ce727a6be914.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_ce727a6be914.nhc]- [targetUID: 00000000-00005580] "bteuns.pt.nhpart_ce727a6be914" has type "Unknown"- Location: [%APPDATA%\comain_ev2c34\bteuns.pt.nhpart_ce727a6be914]- [targetUID: 00000000-00005580] "nh_419feabca584.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_419feabca584.nhc]- [targetUID: 00000000-00005580] "bnymir.ou.nhpart_419feabca584" has type "Unknown"- Location: [%APPDATA%\comain_ev2c34\bnymir.ou.nhpart_419feabca584]- [targetUID: 00000000-00005580] "MbbCx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\MbbCx.sys]- [targetUID: 00000000-00005580] "volmgrx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\volmgrx.sys]- [targetUID: 00000000-00005580] "msquic.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 13 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msquic.sys]- [targetUID: 00000000-00005580] "nh_8b7dd226f6f2.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_8b7dd226f6f2.nhc]- [targetUID: 00000000-00005580] "ntrin.er.nhpart_8b7dd226f6f2" has type "Unknown"- Location: [%APPDATA%\comain_ev2f79\ntrin.er.nhpart_8b7dd226f6f2]- [targetUID: 00000000-00005580] "nh_809b48356e46.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_809b48356e46.nhc]- [targetUID: 00000000-00005580] "cmrsk.ce.nhpart_809b48356e46" has type "Unknown"- Location: [%APPDATA%\comain_ev2c34\cmrsk.ce.nhpart_809b48356e46]- [targetUID: 00000000-00005580] "nh_7529123106ed.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_7529123106ed.nhc]- [targetUID: 00000000-00005580] "otrm.oi.nhpart_7529123106ed" has type "Unknown"- Location: [%APPDATA%\comain_ev2f79\otrm.oi.nhpart_7529123106ed]- [targetUID: 00000000-00005580] "nh_393638b58a58.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_393638b58a58.nhc]- [targetUID: 00000000-00005580] "fhkan.oi.nhpart_393638b58a58" has type "Unknown"- Location: [%APPDATA%\comain_ev2c34\fhkan.oi.nhpart_393638b58a58]- [targetUID: 00000000-00005580] "mountmgr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mountmgr.sys]- [targetUID: 00000000-00005580] "volmgr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\volmgr.sys]- [targetUID: 00000000-00005580] "rspndr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\rspndr.sys]- [targetUID: 00000000-00005580] "BTHPRINT.SYS" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 11 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\BTHPRINT.SYS]- [targetUID: 00000000-00005580] "PSHED.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 12 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\PSHED.DLL]- [targetUID: 00000000-00005580] "winverbs.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\winverbs.sys]- [targetUID: 00000000-00005580] "nh_d759ea87c9f5.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_d759ea87c9f5.nhc]- [targetUID: 00000000-00005580] "dxyvnb.ti.nhpart_d759ea87c9f5" has type "Unknown"- Location: [%APPDATA%\comain_ev2f79\dxyvnb.ti.nhpart_d759ea87c9f5]- [targetUID: 00000000-00005580] "StartupProfileData-NonInteractive" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004248] "Dmpusbstor.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 11 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Dmpusbstor.sys]- [targetUID: 00000000-00005580] "KBDSMSFI.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\KBDSMSFI.DLL]- [targetUID: 00000000-00005580] "KBDIULAT.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\KBDIULAT.DLL]- [targetUID: 00000000-00005580] "KBDNE.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\KBDNE.DLL]- [targetUID: 00000000-00005580] "nh_c03f8c02ae29.nhc" has type "Unknown"- Location: [%TEMP%\nsmE384.tmp\nh_c03f8c02ae29.nhc]- [targetUID: 00000000-00005580] "ap.asin" has type "Unknown"- Location: [%APPDATA%\ap.asin]- [targetUID: 00000000-00004324] "se_tmp.txt" has type "Unknown"- Location: [%TEMP%\se_tmp.txt]- [targetUID: 00000000-00002196] "bnymir.ou" has type "Unknown"- Location: [%APPDATA%\bnymir.ou]- [targetUID: 00000000-00004324] "ap.asin.nhpart_c03f8c02ae29" has type "Unknown"- Location: [%APPDATA%\comain_ev2c34\ap.asin.nhpart_c03f8c02ae29]- [targetUID: 00000000-00005580] "uk_tmp.txt" has type "Unknown"- Location: [%TEMP%\uk_tmp.txt]- [targetUID: 00000000-00004324]49:T5eb,"Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")4a:T11aa,"vulkan-1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 13 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1.dll]- [targetUID: 00000000-00005580] "NetPeerDistCim.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\NetPeerDistCim.dll]- [targetUID: 00000000-00005580] "vulkan-1-32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1-32.dll]- [targetUID: 00000000-00005580] "gdi32full.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\gdi32full.dll]- [targetUID: 00000000-00005580] "SettingSyncCore.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\SettingSyncCore.dll]- [targetUID: 00000000-00005580] "WpdMtpDr.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WpdMtpDr.dll]- [targetUID: 00000000-00005580] "odbc32.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\odbc32.dll]- [targetUID: 00000000-00005580] "internetmail.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\internetmail.dll]- [targetUID: 00000000-00005580] "Intel_OpenCL_ICD64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Intel_OpenCL_ICD64.dll]- [targetUID: 00000000-00005580] "Windows.Gaming.XboxLive.Storage.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Gaming.XboxLive.Storage.dll]- [targetUID: 00000000-00005580] "mdmregistration.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mdmregistration.dll]- [targetUID: 00000000-00005580] "igfxDIN.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\igfxDIN.dll]- [targetUID: 00000000-00005580] "es.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\es.dll]- [targetUID: 00000000-00005580] "pdh.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\pdh.dll]- [targetUID: 00000000-00005580] "smartscreenps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\smartscreenps.dll]- [targetUID: 00000000-00005580] "wdsutil.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wdsutil.dll]- [targetUID: 00000000-00005580] "DAFWSD.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\DAFWSD.dll]- [targetUID: 00000000-00005580] "TtlsAuth.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\TtlsAuth.dll]- [targetUID: 00000000-00005580] "JHI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\JHI.dll]- [targetUID: 00000000-00005580] "psmsrv.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\psmsrv.dll]- [targetUID: 00000000-00005580] "Windows.Media.Streaming.ps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Media.Streaming.ps.dll]- [targetUID: 00000000-00005580] "RDCameraMediaSource.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\RDCameraMediaSource.dll]- [targetUID: 00000000-00005580] "W32UIRes.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\W32UIRes.dll]- [targetUID: 00000000-00005580] "ipmiprv.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\ipmiprv.dll]- [targetUID: 00000000-00005580] "EsclWiaDriver.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\EsclWiaDriver.dll]- [targetUID: 00000000-00005580]4b:Tcbc,"Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DRV_CEO_12.8.1_X64.EXE"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DRV_CEO_12.8.1_X64"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "")4c:T4a6,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify sandbox environment running process Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size4d:T6ee,"Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\NSEXEC.DLL" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nsExec.dll" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\CMD.EXE" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\cmd.exe" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\SYSTEM.DLL" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\System.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "tasklist.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\BCRYPT.DLL" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\bcrypt.dll"4e:T70e,"Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\DRV_CEO_12.8.1_X64.EXE.LOCAL" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\NH_ECA71A8195CE.NHC" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_eca71a8195ce.nhc" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\NH_8B7DD226F6F2.NHC" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_8b7dd226f6f2.nhc" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\NH_7529123106ED.NHC" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_7529123106ed.nhc" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\NH_39F7B8FB60CD.NHC" "Drv_ceo_12.8.1_x64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_39f7b8fb60cd.nhc" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"4f:T763,file/memory contains long string with (Indicator: "WlanCloseHandle"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanDisconnect"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanEnumInterfaces"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanFreeMemory"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanGetAvailableNetworkList"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanGetProfile"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanGetProfileList"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanOpenHandle"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanQueryInterface"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanSaveTemporaryProfile"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanSetProfile"; File: "msoobewirelessplugin.dll") file/memory contains long string with (Indicator: "WlanCloseHandle"; File: "WlanRadioManager.dll") file/memory contains long string with (Indicator: "WlanEnumInterfaces"; File: "WlanRadioManager.dll") file/memory contains long string with (Indicator: "WlanFreeMemory"; File: "WlanRadioManager.dll") file/memory contains long string with (Indicator: "WlanGetInterfaceCapability"; File: "WlanRadioManager.dll") file/memory contains long string with (Indicator: "WlanOpenHandle"; File: "WlanRadioManager.dll") file/memory contains long string with (Indicator: "WlanQueryInterface"; File: "WlanRadioManager.dll") file/memory contains long string with (Indicator: "WlanRegisterNotification"; File: "WlanRadioManager.dll")50:T420,"2.5.29.37" "2.5.29.35" "1.3.251.21" "1.3.99.0" Potential IP "4.0.0.0" found in string "System.Xml,4.0.0.0,,b77a5c561934e089" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ystem.Data.SqlXml,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "ystem.Xml,4.0.0.0,,b77a5c561934e089" "2.5.29.15" "2.5.29.19" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.31" "2.5.29.17" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" "2.5.29.10" "2.5.29.1" "2.5.4.3" "2.5.29.16" "1.1.0.1" "3.0.0.0" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "ft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" "2.5.4.10" "2.5.4.6" "2.5.4.5" "2.5.4.8" "2.5.4.7" "2.5.4.11"51:T18e3,Pattern match: "http://nsis.sf.net/nsis_error" Heuristic match: "c}.ar" Heuristic match: "!l/k4.mm" Heuristic match: "4l.eg" Heuristic match: "[^.nz" Heuristic match: ";.~.ve" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuowashington1redmond1microsoft" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mv[p+:cf;@washington1redmond1microsoft" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0ufg.5;;7washington1redmond1" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0ufg.5;;7washington1redmond1microsoft" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0trow^xld,?2+l+x`rff+;washington1redmond1microsoft" Pattern match: "0.fz/+x?kl{x#oi\hoy\*o~wrzzod1@*`p~btc97" Pattern match: "s2.yz/ty%2$whvdut'd!xcs^$csenb]~ppxr/tp0%ryw9'/qj;3i" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k{uksuswbx6syy'q\y-g" Heuristic match: "%appdata%\comain_ev2f79\ntrin.er" Heuristic match: "%appdata%\comain_ev2f79\yinma.vc" Heuristic match: "%appdata%\comain_ev2c34\bteuns.pt" Heuristic match: "ri.mc" Heuristic match: "uu.la" Heuristic match: "go.dj" Heuristic match: "4m~.cv" Heuristic match: "j{.mc" Heuristic match: "fq<.mw" Heuristic match: "^o.gw" Heuristic match: "`s.th" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "microsoft.net/assembly/gac_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "ntrust.net" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.usertrust.com/add" Heuristic match: "16299.15.cat" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: "stem.co" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0"52:T4117,Found URL "http://www.microsoft.com0'6*ldigicert" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%yglobalsign" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl099h>pca3.crl0internet1verisign," - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004248.00000000.272896.07C02000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00004248.00000000.272896.07C02000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ll*rrdigicert" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;;" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl099h>internet1verisign," - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004248.00000001.274074.07C0F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ll*rrl*rrl*rrl*rrl*rrl*rr=wpt=wpt=wp=wpil*rrl*rrl*rr1.3.132.0.30@eckp1.3.132.0.10ecdp1.3.132.0.10@eckp1.3.132.0.35@eckp" - Source: "00000000-00004248.00000001.274074.07C0F000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00004248.00000001.274074.07C0F000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00004248.00000001.274074.07C0F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004248.00000001.274074.07C0F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0nvznqgq2ohlehtna04v9w3kdgd1qhv0oihfeezccbbwwggokoamc" - Source: "00000000-00004248.00000001.274074.08E1F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.micro/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004248.00000001.274074.08E1F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!" - Source: "00000000-00004248.00000001.274074.08E1F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004248.00000001.274074.08E1F000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004248.00000001.274074.6F501000.00000020.mdmp")53:T47f,Found registry query API: "RegEnumValueA" in file "Drv_ceo_12.8.1_x64.exe" Found registry query API: "RegEnumKeyA" in file "Drv_ceo_12.8.1_x64.exe" Found registry query API: "RegQueryValueExA" in file "Drv_ceo_12.8.1_x64.exe" Found registry query API: "RegOpenKeyExA" in file "Drv_ceo_12.8.1_x64.exe" Found registry query API: "RegOpenKeyExA" in "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004248.00000001.274074.00C61000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004248.00000001.274074.00C61000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004248.00000001.274074.00C61000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004248.00000001.274074.00C61000.00000002.mdmp"54:Ta64,file/memory contains long string with (Indicator: "aes"; File: "nh_809b48356e46.nhc") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.00C51000.00000020.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000001.274074.03320000.00000004.mdmp, 00000000-00004248.00000001.274074.08E1F000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.05330000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004248.00000000.272896.05330000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004248.00000001.274074.03320000.00000004.mdmp, 00000000-00004248.00000001.274074.07C0F000.00000004.mdmp")55:Td5a,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "nsExec.dll") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "nsExec.dll") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")56:T57c,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "nsExec.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")57:Tab9,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "GetTempFileName"; File: "nsExec.dll") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00002196.00000000.273033.00A11000.00000020.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")58:T4a9,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "Drv_ceo_12.8.1_x64.exe") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00007100.00000000.272518.00AE1000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "SeDebugPrivilegey" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004248.00000000.272896.03300000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004248.00000000.272896.05330000.00000004.mdmp")59:Td18,file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "nsExec.dll") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "nsExec.dll") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp")5a:T4d1,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "Drv_ceo_12.8.1_x64.exe") file/memory contains long string with (Indicator: "ExitProcess"; File: "nsExec.dll") file/memory contains long string with (Indicator: "TerminateProcess"; File: "nsExec.dll") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp")5b:T9d4,"Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\COMAIN_EV2F79\EV2F79.EXE"; Value: "") "Drv_ceo_12.8.1_x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\COMAIN_EV2C34\EV2C34.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKLIST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\FINDSTR.EXE"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")5c:T454,"Drv_ceo_12.8.1_x64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFTUSERADMIN"; Key: "SOURCE"; Value: "TikTok Installer") "Drv_ceo_12.8.1_x64.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "%TEMP%\nsmE384.tmp\8e555392\") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")5d:T11cb,"vulkan-1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 13 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1.dll]- [targetUID: 00000000-00005580] "NetPeerDistCim.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\NetPeerDistCim.dll]- [targetUID: 00000000-00005580] "vulkan-1-32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1-32.dll]- [targetUID: 00000000-00005580] "gdi32full.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\gdi32full.dll]- [targetUID: 00000000-00005580] "SettingSyncCore.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\SettingSyncCore.dll]- [targetUID: 00000000-00005580] "WpdMtpDr.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WpdMtpDr.dll]- [targetUID: 00000000-00005580] "odbc32.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\odbc32.dll]- [targetUID: 00000000-00005580] "internetmail.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\internetmail.dll]- [targetUID: 00000000-00005580] "Intel_OpenCL_ICD64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Intel_OpenCL_ICD64.dll]- [targetUID: 00000000-00005580] "Windows.Gaming.XboxLive.Storage.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Gaming.XboxLive.Storage.dll]- [targetUID: 00000000-00005580] "mdmregistration.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mdmregistration.dll]- [targetUID: 00000000-00005580] "igfxDIN.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\igfxDIN.dll]- [targetUID: 00000000-00005580] "es.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\es.dll]- [targetUID: 00000000-00005580] "pdh.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\pdh.dll]- [targetUID: 00000000-00005580] "smartscreenps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\smartscreenps.dll]- [targetUID: 00000000-00005580] "wdsutil.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wdsutil.dll]- [targetUID: 00000000-00005580] "directxdatabaseupdater.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\directxdatabaseupdater.exe]- [targetUID: 00000000-00005580] "DAFWSD.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\DAFWSD.dll]- [targetUID: 00000000-00005580] "TtlsAuth.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\TtlsAuth.dll]- [targetUID: 00000000-00005580] "PresentationHost.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\PresentationHost.exe]- [targetUID: 00000000-00005580] "JHI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\JHI.dll]- [targetUID: 00000000-00005580] "psmsrv.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\psmsrv.dll]- [targetUID: 00000000-00005580] "wermgr.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wermgr.exe]- [targetUID: 00000000-00005580] "Windows.Media.Streaming.ps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Media.Streaming.ps.dll]- [targetUID: 00000000-00005580] "RDCameraMediaSource.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\RDCameraMediaSource.dll]- [targetUID: 00000000-00005580]5e:T84b,Dropped file: "ev2f79.exe.nhpart_eca71a8195ce" - Location: [%APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_eca71a8195ce]- [targetUID: 00000000-00005580] Dropped file: "ev2c34.exe.nhpart_2d004296fcc8" - Location: [%APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_2d004296fcc8]- [targetUID: 00000000-00005580] Dropped file: "powershell.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00004248] Dropped file: "yinma.vc.nhpart_39f7b8fb60cd" - Location: [%APPDATA%\comain_ev2f79\yinma.vc.nhpart_39f7b8fb60cd]- [targetUID: 00000000-00005580] Dropped file: "bteuns.pt.nhpart_ce727a6be914" - Location: [%APPDATA%\comain_ev2c34\bteuns.pt.nhpart_ce727a6be914]- [targetUID: 00000000-00005580] Dropped file: "bnymir.ou.nhpart_419feabca584" - Location: [%APPDATA%\comain_ev2c34\bnymir.ou.nhpart_419feabca584]- [targetUID: 00000000-00005580] Dropped file: "ntrin.er.nhpart_8b7dd226f6f2" - Location: [%APPDATA%\comain_ev2f79\ntrin.er.nhpart_8b7dd226f6f2]- [targetUID: 00000000-00005580] Dropped file: "cmrsk.ce.nhpart_809b48356e46" - Location: [%APPDATA%\comain_ev2c34\cmrsk.ce.nhpart_809b48356e46]- [targetUID: 00000000-00005580] Dropped file: "otrm.oi.nhpart_7529123106ed" - Location: [%APPDATA%\comain_ev2f79\otrm.oi.nhpart_7529123106ed]- [targetUID: 00000000-00005580] Dropped file: "fhkan.oi.nhpart_393638b58a58" - Location: [%APPDATA%\comain_ev2c34\fhkan.oi.nhpart_393638b58a58]- [targetUID: 00000000-00005580] Dropped file: "dxyvnb.ti.nhpart_d759ea87c9f5" - Location: [%APPDATA%\comain_ev2f79\dxyvnb.ti.nhpart_d759ea87c9f5]- [targetUID: 00000000-00005580] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004248] Dropped file: "ap.asin" - Location: [%APPDATA%\ap.asin]- [targetUID: 00000000-00004324] Dropped file: "bnymir.ou" - Location: [%APPDATA%\bnymir.ou]- [targetUID: 00000000-00004324] Dropped file: "ap.asin.nhpart_c03f8c02ae29" - Location: [%APPDATA%\comain_ev2c34\ap.asin.nhpart_c03f8c02ae29]- [targetUID: 00000000-00005580]5f:Ta05,Found string "MulDiv" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "DeleteFileA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "SearchPathA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "GetShortPathNameA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNEL32.DLL) Found string "GetFullPathNameA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL) Found string "MoveFileA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNEL32.DLL) Found string "SetCurrentDirectoryA" (Source: Drv_ceo_12.8.1_x64.exe, API is part of module: KERNELBASE.DLL)60:T556,SizeofResource@KERNEL32.DLL at 00000000-00002196-45183-271-00A15220 SizeofResource@KERNEL32.DLL at 00000000-00002196-45183-274-00A150C0 SizeofResource@KERNEL32.DLL at 00000000-00002196-45183-276-00A15010 SizeofResource@KERNEL32.DLL at 00000000-00002196-45183-278-00A14FA0 FindResourceExW@KERNEL32.DLL at 00000000-00002196-45183-313-00A13484 FindResourceW@KERNEL32.DLL at 00000000-00002196-45183-314-00A13794 LoadResource@KERNEL32.DLL at 00000000-00002196-45183-317-00A11195 FindResourceW@KERNEL32.DLL at 00000000-00002196-45183-475-00A11A73 FindResourceW@KERNEL32.DLL at 00000000-00002196-45183-498-00A127A1 LoadResource@KERNEL32.DLL at 00000000-00002196-45183-512-00A143D1 SizeofResource@KERNEL32.DLL at 00000000-00004324-46009-271-01395220 SizeofResource@KERNEL32.DLL at 00000000-00004324-46009-274-013950C0 SizeofResource@KERNEL32.DLL at 00000000-00004324-46009-276-01395010 SizeofResource@KERNEL32.DLL at 00000000-00004324-46009-278-01394FA0 FindResourceExW@KERNEL32.DLL at 00000000-00004324-46009-313-01393484 FindResourceW@KERNEL32.DLL at 00000000-00004324-46009-314-01393794 LoadResource@KERNEL32.DLL at 00000000-00004324-46009-317-01391195 FindResourceW@KERNEL32.DLL at 00000000-00004324-46009-475-01391A73 FindResourceW@KERNEL32.DLL at 00000000-00004324-46009-498-013927A1 LoadResource@KERNEL32.DLL at 00000000-00004324-46009-512-013943D161:T37a8,"ev2f79.exe.nhpart_eca71a8195ce" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_eca71a8195ce]- [targetUID: 00000000-00005580] "ev2c34.exe.nhpart_2d004296fcc8" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_2d004296fcc8]- [targetUID: 00000000-00005580] "vulkan-1.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 13 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1.dll]- [targetUID: 00000000-00005580] "NetPeerDistCim.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\NetPeerDistCim.dll]- [targetUID: 00000000-00005580] "vulkan-1-32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\vulkan-1-32.dll]- [targetUID: 00000000-00005580] "TikTok Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\Community\TikTok Installer.exe]- [targetUID: 00000000-00005580] "gdi32full.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\gdi32full.dll]- [targetUID: 00000000-00005580] "SettingSyncCore.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\SettingSyncCore.dll]- [targetUID: 00000000-00005580] "WpdMtpDr.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WpdMtpDr.dll]- [targetUID: 00000000-00005580] "odbc32.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\odbc32.dll]- [targetUID: 00000000-00005580] "internetmail.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\internetmail.dll]- [targetUID: 00000000-00005580] "Intel_OpenCL_ICD64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Intel_OpenCL_ICD64.dll]- [targetUID: 00000000-00005580] "Windows.Gaming.XboxLive.Storage.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Gaming.XboxLive.Storage.dll]- [targetUID: 00000000-00005580] "mdmregistration.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mdmregistration.dll]- [targetUID: 00000000-00005580] "igfxDIN.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\igfxDIN.dll]- [targetUID: 00000000-00005580] "es.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\es.dll]- [targetUID: 00000000-00005580] "pdh.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\pdh.dll]- [targetUID: 00000000-00005580] "smartscreenps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\smartscreenps.dll]- [targetUID: 00000000-00005580] "wdsutil.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wdsutil.dll]- [targetUID: 00000000-00005580] "directxdatabaseupdater.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\directxdatabaseupdater.exe]- [targetUID: 00000000-00005580] "DAFWSD.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\DAFWSD.dll]- [targetUID: 00000000-00005580] "TtlsAuth.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\TtlsAuth.dll]- [targetUID: 00000000-00005580] "PresentationHost.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\PresentationHost.exe]- [targetUID: 00000000-00005580] "JHI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\JHI.dll]- [targetUID: 00000000-00005580] "psmsrv.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\psmsrv.dll]- [targetUID: 00000000-00005580] "wermgr.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wermgr.exe]- [targetUID: 00000000-00005580] "Windows.Media.Streaming.ps.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Windows.Media.Streaming.ps.dll]- [targetUID: 00000000-00005580] "RDCameraMediaSource.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\RDCameraMediaSource.dll]- [targetUID: 00000000-00005580] "W32UIRes.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\W32UIRes.dll]- [targetUID: 00000000-00005580] "ipmiprv.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\ipmiprv.dll]- [targetUID: 00000000-00005580] "EsclWiaDriver.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\EsclWiaDriver.dll]- [targetUID: 00000000-00005580] "fhshl.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\fhshl.dll]- [targetUID: 00000000-00005580] "msaudite.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msaudite.dll]- [targetUID: 00000000-00005580] "StorFwUpdate.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\StorFwUpdate.dll]- [targetUID: 00000000-00005580] "RjvPlatform.dll" has type "PE32+ executable for MS Windows 6.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\RjvPlatform.dll]- [targetUID: 00000000-00005580] "msdtcstp.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msdtcstp.dll]- [targetUID: 00000000-00005580] "netfxperf.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\netfxperf.dll]- [targetUID: 00000000-00005580] "sethc.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\sethc.exe]- [targetUID: 00000000-00005580] "AppListBackupLauncher.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\AppListBackupLauncher.dll]- [targetUID: 00000000-00005580] "msoobewirelessplugin.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msoobewirelessplugin.dll]- [targetUID: 00000000-00005580] "MitigationConfiguration.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\MitigationConfiguration.dll]- [targetUID: 00000000-00005580] "WinMgmt.exe" has type "PE32+ executable for MS Windows 10.00 (console) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WinMgmt.exe]- [targetUID: 00000000-00005580] "TableTextServiceMig.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\TableTextServiceMig.dll]- [targetUID: 00000000-00005580] "tcpmonui.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\tcpmonui.dll]- [targetUID: 00000000-00005580] "mferror.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mferror.dll]- [targetUID: 00000000-00005580] "WlanRadioManager.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\WlanRadioManager.dll]- [targetUID: 00000000-00005580] "kernel.appcore.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\kernel.appcore.dll]- [targetUID: 00000000-00005580] "tssysprep.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\tssysprep.dll]- [targetUID: 00000000-00005580] "GameInputSvc.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\GameInputSvc.exe]- [targetUID: 00000000-00005580] "wsmprovhost.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\wsmprovhost.exe]- [targetUID: 00000000-00005580] "SyncInfrastructureps.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\SyncInfrastructureps.dll]- [targetUID: 00000000-00005580] "Apphlpdm.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Apphlpdm.dll]- [targetUID: 00000000-00005580] "fsutilext.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\fsutilext.dll]- [targetUID: 00000000-00005580] "GamePanelExternalHook.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\GamePanelExternalHook.dll]- [targetUID: 00000000-00005580] "shgina.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\shgina.dll]- [targetUID: 00000000-00005580] "DscTimer.dll" has type "PE32+ executable for MS Windows 6.01 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\DscTimer.dll]- [targetUID: 00000000-00005580] "dllhost.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\dllhost.exe]- [targetUID: 00000000-00005580] "LangCleanupSysprepAction.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\LangCleanupSysprepAction.dll]- [targetUID: 00000000-00005580] "coreaudiopolicymanagerext.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\coreaudiopolicymanagerext.dll]- [targetUID: 00000000-00005580] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsmE384.tmp\System.dll]- [targetUID: 00000000-00005580] "api-ms-win-core-stringloader-l1-1-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 2 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\api-ms-win-core-stringloader-l1-1-1.dll]- [targetUID: 00000000-00005580] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsmE384.tmp\nsExec.dll]- [targetUID: 00000000-00005580] "adp80xx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\adp80xx.sys]- [targetUID: 00000000-00005580] "PCL5URES.DLL" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64"- Location: [%TEMP%\nsmE384.tmp\8e555392\PCL5URES.DLL]- [targetUID: 00000000-00005580] "iaStorAVC.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 9 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\iaStorAVC.sys]- [targetUID: 00000000-00005580] "MbbCx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\MbbCx.sys]- [targetUID: 00000000-00005580] "volmgrx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\volmgrx.sys]- [targetUID: 00000000-00005580] "msquic.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 13 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\msquic.sys]- [targetUID: 00000000-00005580] "mountmgr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\mountmgr.sys]- [targetUID: 00000000-00005580] "volmgr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\volmgr.sys]- [targetUID: 00000000-00005580] "rspndr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\rspndr.sys]- [targetUID: 00000000-00005580] "BTHPRINT.SYS" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 11 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\BTHPRINT.SYS]- [targetUID: 00000000-00005580] "PSHED.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 12 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\PSHED.DLL]- [targetUID: 00000000-00005580] "winverbs.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\winverbs.sys]- [targetUID: 00000000-00005580] "Dmpusbstor.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 11 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\Dmpusbstor.sys]- [targetUID: 00000000-00005580] "KBDSMSFI.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\KBDSMSFI.DLL]- [targetUID: 00000000-00005580] "KBDIULAT.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\KBDIULAT.DLL]- [targetUID: 00000000-00005580] "KBDNE.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections"- Location: [%TEMP%\nsmE384.tmp\8e555392\KBDNE.DLL]- [targetUID: 00000000-00005580]62:Tebb,"Drv_ceo_12.8.1_x64.exe" wrote 6656 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nsExec.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 16384 bytes starting with PE header signature to file "C:\Program Files (x86)\Community\TikTok Installer.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\LangCleanupSysprepAction.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\tssysprep.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\Dmpusbstor.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\TtlsAuth.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\volmgr.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Drv_ceo_12.8.1_x64.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\SettingSyncCore.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...63:Tb9a,"Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsxE2D7.tmp" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_eca71a8195ce.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_8b7dd226f6f2.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_7529123106ed.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_39f7b8fb60cd.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_d759ea87c9f5.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_2d004296fcc8.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_419feabca584.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_ce727a6be914.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_809b48356e46.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_393638b58a58.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_c03f8c02ae29.nhc" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\adp80xx.sys" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\api-ms-win-core-stringloader-l1-1-1.dll" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\Apphlpdm.dll" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\AppListBackupLauncher.dll" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\BTHPRINT.SYS" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\coreaudiopolicymanagerext.dll" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\DAFWSD.dll" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\directxdatabaseupdater.exe" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\dllhost.exe" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\Dmpusbstor.sys" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\DscTimer.dll" for deletion "Drv_ceo_12.8.1_x64.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\8e555392\es.dll" for deletion64:T56f,"Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsxE2D7.tmp" with delete access "Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp" with delete access "Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ev2f79.exe.nhpart_eca71a8195ce" with delete access "Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_eca71a8195ce.nhc" with delete access "Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ntrin.er.nhpart_8b7dd226f6f2" with delete access "Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_8b7dd226f6f2.nhc" with delete access "Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\otrm.oi.nhpart_7529123106ed" with delete access "Drv_ceo_12.8.1_x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE384.tmp\nh_7529123106ed.nhc" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_m1udahpl.nia.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_jhcwhabl.f4l.psm1" with delete access "ev2f79.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU8BE.tmp" with delete access "ev2c34.exe" opened "C:\Program Files (x86)\Microsoft\Temp\EU15DD.tmp" with delete access65:T55d,"adp80xx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 9 sections" "iaStorAVC.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 9 sections" "MbbCx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections" "volmgrx.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections" "msquic.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 13 sections" "mountmgr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections" "volmgr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections" "rspndr.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 10 sections" "BTHPRINT.SYS" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 11 sections" "PSHED.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 12 sections" "winverbs.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections" "Dmpusbstor.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 11 sections" "KBDSMSFI.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections" "KBDIULAT.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections" "KBDNE.DLL" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 4 sections"66:T918,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGmUlEQVR4Xt2SWVCVZRjHbdTDAQUOKMsBDps6XXndjBuugPuCuSIoIAe30FLcKnPhlJZboOaaC4qIu2ha5jBMuWam4zp1kd7VjQq4gfrvWb7347g04zRNF30zv3mf7+Pw/p6tWbM3fNz7GxB9oFFwC0+FpnfrG/+u7E90vPkMHa8DL9/zjx9naS0C1tS/hjo46bSh3zmX3UH78w/R7mzdv5fA//dp7v0eLQtOSqv4VL6DI+cgQvbcQXDFbYkd3m/luw298zeH9wQCvMfhyP8GAczEowjIqkCLjTfRfP0NOLN3IzD3MJy5R+g8QudhOg8hiO6UBIzUxI5JmkDLnENoUXIFzUsuw0H/oDIin4Un6DxuCZljcJLYmXcUgXkkoQSaLb+It4ig7AoE5hwQWBrE54R9aEW8JgGuTKsLyD8GR3YlHFl76OIqW+ak00nCgDwWVmllLJXKGJKMr0TgmG0IGrsdQZRM0Ph9xF6hFZO9h6g0CaiQY65OKzuuVbGALxc4ViHLnNShQMMEro4rOyCyJkmFBcWUSGuKW2ftVsbt0gRY5qDKJM4zldEcRaTVaWU0t1wWHlShsF/aqRVWSlXCC7JykjG7EDxup5JZhuCxO6wErMo49l8SJ4uMTKrbT3MjpMJ9dlU240xl5QhmaSYJM3fSWWYLg2kkITQagyQgrSShJCCLorJAlnB12Tw3U51KY7x7UXPjD/Bz5MIdxHkrqDKtMISkKtuBEBYKLNyKUGb01wgdtQWuUZs1AdNKie0laZJJOxlpY7mIvOtqRP78uVK09bRKSBZKZyhXyCJhCwk3C65RmxA6ciNcIzfANWKDJmDmJrGRWa00Qm6ltJGhy30V50j8HM+ePZPTt/sMQvhykamQK3SJbKPImLCR6xE24iuEvcus0wSMjGNto59Q2vjS7OhiX/lpkTNPnz6Fb9cPJFjvJ1wvMpeIVBYurEX48DVKRokmoFu5U15CMkk2xpJxS0f7zU2gVlL7fLt+FHFjY6Pg21kDF13qIgnLwljkLxteKsLwYV+iTQYxbLUgCZglkdh/btbstJWbrOqolXQxCxsaGuwEindUq8DIhpeQiIUkylBZ22Gr0HboSiFi6Aq0HbJcEzAyjkVGs3SN0laGybLo3MJHaBvDMkpRXFYtCTBPnjxB8fZTaEMXa3WrbFkbFlmytkO+QCSdEXRGDP4ckYQkYCrjWJfELIoKE7I2ovry7yI7dPoWEseuEeHjx49tiredRNLo1Th18Tc8evQIB2quInnMapFFDlFZxKClQhQROfBTQRKQJRmhGxk2vGl2baxFKVhZJVUyLPvpxh2UVNaIyFBSUY0L12/jwYMHNkVrqhA5iESDPrOEPkQxA4oR1X8Jogcs0QR0I0vlhecmbbRayS0sWntUxP5C5uHDhyIyp6G+vl4o8JWRZLEKSRbVfzGihUVw918Id7+FmoDZSo5ldsN0UXhu3MKkjGJcuPqrLTW8LDTU1dXh3C830G7gfESTROj7Cdw2HxMfwZ3+oSagm7lCXiJYOliXRBdlGSKoXYkD5+L8lVuvCFnmT21tLc5dInnfmYhOm2fJiHQVxqTNJ+YhJnUeYumUBEQ0RDcycvBSnZm9KD5E0xyj+i5Acv8inLt88xVxba2K79+/j7OXrqN9+gy4+8xGTPp8JU1lsWlzEZs6B3FEbJ8iQRIwSyLxgKZFiRasuXEbKfvkfjNJck2ERsrcu3cPZ36+hvZphXD3nkkVzhGZQMnEkUzoPYvOWfDQb+J6faAJGBnHuiQsXCRSXhR3P7+50WXt0qeLjKWGMxevokPqNMT0el8q85fFkYyFHhJ66O/xhKfndMQTkgBvJcs4VtkCa240M4HbaFo5FzF0WXuSVR45hbt37+JE9Vl06DMVsT0KRcaVeXqrzNNrhsrojO9ZiPge7yndpyGh+1QrAVqQGKqOYxGKbL7MLSZV5xabOluR6qgqutTdJR9R72TC3TkPcXypyFTo6cGyQiTQd8YI41Om0DkFiSmTkditQBOIJZkEHJNQlkRkDLdQ26it5MqsVpIoji72sMRU152FKktgmTDZEk4SaWI3LxK7euHpmq/ehJQFdgKyIK+Zm8CVWbMzbVSmSlVCilVdisqSBC+SSKZMRFKXPCLXdr7ySBvN7ETWNLsEq5Uvypqqe0HYhWVMLpI65yJZyEFypwl4OyX77xMwj5mbkWkrJyFB2lggbWTs6kSWh2QSCizrPAHtmE7jSZxFcTbd8wby//L5C2VBMw0MMDhcAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790613208245,"unified_at":"2026-09-28T16:33:28.245Z","metadata":{"hashes":{"sha256":"0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5","sha1":"6790e1cbf6798382504915d09bbf8b5aacc10dfe","md5":"858d6d91e6d04cb26acb51fcb516f9c1","sha512":"9c38f256706683f6780032f06d7b15a34481cb2cb9c65e9cb2e57adbb5e521e2165d49edfc3302b18c249b4afe76c28cd90e35465356a0a9b8cbb5d741b48700","ssdeep":"393216:xxVCkFeObsJGHu9zwkXiJlrWqMudtVzBNdzV3:xxV7FtluRXFxudrzlR","ssdeep_chunks":["393216:xxVCkFe","393216:xVCkFeO","393216:VCkFeOb","393216:CkFeObs","393216:kFeObsJ","393216:FeObsJG","393216:eObsJGH","393216:ObsJGHu","393216:bsJGHu9","393216:sJGHu9z","393216:JGHu9zw","393216:GHu9zwk","393216:Hu9zwkX","393216:u9zwkXi","393216:9zwkXiJ","393216:zwkXiJl","393216:wkXiJlr","393216:kXiJlrW","393216:XiJlrWq","393216:iJlrWqM","393216:JlrWqMu","393216:lrWqMud","393216:rWqMudt","393216:WqMudtV","393216:qMudtVz","393216:MudtVzB","393216:udtVzBN","393216:dtVzBNd","393216:tVzBNdz","393216:VzBNdzV","393216:zBNdzV3","786432:xxVCkFe","786432:xVCkFeO","786432:VCkFeOb","786432:CkFeObs","786432:kFeObsJ","786432:FeObsJG","786432:eObsJGH","786432:ObsJGHu","786432:bsJGHu9","786432:sJGHu9z","786432:JGHu9zw","786432:GHu9zwk","786432:Hu9zwkX","786432:u9zwkXi","786432:9zwkXiJ","786432:zwkXiJl","786432:wkXiJlr","786432:kXiJlrW","786432:XiJlrWq","786432:iJlrWqM","786432:JlrWqMu","786432:lrWqMud","786432:rWqMudt","786432:WqMudtV","786432:qMudtVz","786432:MudtVzB","786432:udtVzBN","786432:dtVzBNd","786432:tVzBNdz","786432:VzBNdzV","786432:zBNdzV3","393216:xxV7Ftl","393216:xV7Ftlu","393216:V7FtluR","393216:7FtluRX","393216:FtluRXF","393216:tluRXFx","393216:luRXFxu","393216:uRXFxud","393216:RXFxudr","393216:XFxudrz","393216:Fxudrzl","393216:xudrzlR"],"imphash":"57e98d9a5a72c8d7ad8fb7a6a58b3daf"},"file_info":{"file_name":"Drv_ceo_12.8.1_x64.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":15318651,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786202770000,"last_seen":1786202770000,"last_multi_scan":1786202770000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["plugx","ransomware","evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":229,"suspicious_count":12,"malicious_count":5,"total":246},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Able to delete volume snapshots"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Creates file in AppData directory"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Wi-Fi Discovery","attack_id":"T1016.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/002","identifiers":[{"type":"informative","value":"Contains Wi-Fi native api calls"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Contains system command string that can search for a specific process"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"malicious","value":"Drops system driver"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Able to download payload via Wget"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00004248)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00004248)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00004248)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '143982593', 'hResInfo': '143983840'}\" (UID: 00000000-00004248)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '143982593', 'hResInfo': '143983872'}\" (UID: 00000000-00004248)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '143982593', 'hResInfo': '143983888'}\" (UID: 00000000-00004248)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '143982593', 'hResInfo': '143983856'}\" (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsmE384.tmp\\8e555392\\ (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsmE384.tmp\\ (UID: 00000000-00005580)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data.\" (Indicator: \"Format-Hex\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")\n Found string \"function Format-Hex\" (Indicator: \"Format-Hex\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")\n Found string \"# valid values (supported on all paltforms where Format-Hex is avaliable)\" (Indicator: \"Format-Hex\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")\n Found string \"# 170..180 | format-hex\" (Indicator: \"Format-Hex\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigA\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"nh_809b48356e46.nhc\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"nh_393638b58a58.nhc\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"rspndr.sys\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000000.272896.07C02000.00000004.mdmp, 00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004324.00000000.273209.06180000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007100.00000000.272518.04CD0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72BE0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2d","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Drv_ceo_12.8.1_x64.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007100-36883-141-00AEEFF0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007100-36883-146-00AEEDA4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-45183-41-00A1EA7A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-45183-43-00A18C13\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-45183-50-00A1877F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-45183-241-00A18912\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004324-46009-41-0139EA7A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004324-46009-43-01398C13\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004324-46009-50-0139877F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004324-46009-241-01398912","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005580-00000C2C-3264143577\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00005580-00000C2C-3264168830\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00005580-00000C2C-3264188503\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00005580-00000C2C-3264193007\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00005580-00000C2C-3264255843\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2e","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002196.00000000.273033.02E70000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000001.274074.03300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – Encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004248-00000C2C-3267050479\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004248-00000C2C-3268344536\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Source: \"00000000-00005580-00000C46-2227862546\")\n Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00002008-00000C47-427132112\")\n Found string \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Source: \"00000000-00002008-00000C47-427132112\")\n Found string \"%WINDIR%\\SysWOW64\\findstr.exe\" (Source: \"00000000-00002008-00000BC0-3257738132\")\n Found string \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"msdtcstp.dll\")\n file/memory contains long string(File: \"sethc.exe\")\n file/memory contains long string(File: \"shgina.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004248.00000000.272896.06330000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004248.00000000.272896.06330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"GetSystemFirmwareTable\"; File: \"tssysprep.dll\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004248-00000C2C-3267050479\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004248-00000C2C-3268344536\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"sethc.exe\")\n file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"GameInputSvc.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"sethc.exe\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"tssysprep.dll\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004248-00000C2C-3265332527\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004248-00000C2C-3265332966\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004248-00000C2C-3269614123\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004248-00000C2C-3269614149\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"JHI.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in file \"Drv_ceo_12.8.1_x64.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\"\n Found system information discovery API: \"833422,3976,3127,,GetNativeSystemInfo,kernel32.dll,\"01:11:03.984\",RX=0,PX=0\" in \"00000000-00004248.00000000.272896.03300000.00000004.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005580)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004248)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004248)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005580)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"IsWow64Process\" with parameter \"5580\" - (UID: 00000000-00005580)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4248\" - (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005580)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002008)\n \"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007100)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000312)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002280)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"ev2c34.exe\" called \"OpenMutexA\" with parameter \"Local\\dXBsaW5l\" - (UID: 00000000-00004324)\n \"ev2c34.exe\" called \"OpenMutexA\" with parameter \"Local\\bG9jYWxndWFyZA\" - (UID: 00000000-00004324)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004248)\n \"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000000000000f038000000000000000a114000094cc350aee137f7780000000ee137f77000000000000000080000000f062fa7200000000b4cc350a5072617500000f030000000080000000f062fa7202000000002ffa72d0cc350afb62fa72010000008004fb72885f63750000000008f52ee200cd350ab864fa72f42efa72 (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004248)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007100)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004248)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007100-36883-337-00AEF203","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"nsExec.dll\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00002196-45183-516-00A1231F\n FindFirstFileW@KERNEL32.DLL at 00000000-00002196-45183-517-00A1207E\n FindFirstFileExW@KERNEL32.DLL at 00000000-00002196-45183-636-00A1F1E6\n FindFirstFileExW@KERNEL32.DLL at 00000000-00004324-46009-516-0139231F\n FindFirstFileW@KERNEL32.DLL at 00000000-00004324-46009-517-0139207E\n FindFirstFileExW@KERNEL32.DLL at 00000000-00004324-46009-636-0139F1E6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"FindWindowExA\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.DLL at 00000000-00007100-36883-220-00AE8E8B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007100-36883-337-00AEF203\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002196-45183-516-00A1231F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002196-45183-517-00A1207E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002196-45183-584-00A1865B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004324-46009-516-0139231F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004324-46009-517-0139207E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004324-46009-584-0139865B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007100-36883-337-00AEF203\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002196-45183-516-00A1231F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002196-45183-517-00A1207E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002196-45183-584-00A1865B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004324-46009-516-0139231F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004324-46009-517-0139207E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004324-46009-584-0139865B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00007100-36883-332-00AE218B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00002196-45183-526-00A11F55\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00004324-46009-526-01391F55","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00002196-45183-742-00A2B9B9\n GetSystemInfo@KERNEL32.DLL at 00000000-00004324-46009-742-013AB9B9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"FindWindow\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver Windows 2000 Service Pack 4 eller nyere.\" (Indicator: \"ver \") in Source: 00000000-00002196.00000000.273033.00A38000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007100-36883-153-00AE8A9A\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-36883-154-00AEAE24\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-36883-155-00AEAC6D\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-36883-170-00AEACA8\n GetProcessHeap@KERNEL32.DLL at 00000000-00007100-36883-189-00AEAD48\n OpenProcess@KERNEL32.DLL at 00000000-00007100-36883-255-00AE4BC2\n OpenProcess@KERNEL32.DLL at 00000000-00007100-36883-267-00AE49CC\n OpenProcessToken@ADVAPI32.DLL at 00000000-00007100-36883-333-00AE2642\n GetProcessHeap@KERNEL32.DLL at 00000000-00002196-45183-306-00A1132B\n GetProcessHeap@KERNEL32.DLL at 00000000-00004324-46009-306-0139132B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"ev2c34.exe\" writes to a file \"%APPDATA%\\bnymir.ou\"\n \"ev2c34.exe\" writes to a file \"%APPDATA%\\ap.asin\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call EnumServicesStatusExW@ADVAPI32.DLL directly followed by \"cmp eax, 01h\" and \"je 00AE63A5h\" at 00000000-00007100-36883-274-00AE62AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSME384.TMP\\NSEXEC.DLL\n %TEMP%\\NSME384.TMP\\SYSTEM.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ev2f79.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; File: \"00000000-00007100.00000000.272518.00AE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"Drv_ceo_12.8.1_x64.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"GameInputSvc.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005580-00000C2C-3264258749\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"PresentationHost.exe\")\n file/memory contains long string(File: \"JHI.dll\")\n file/memory contains long string(File: \"msdtcstp.dll\")\n file/memory contains long string(File: \"netfxperf.dll\")\n file/memory contains long string(File: \"WinMgmt.exe\")\n file/memory contains long string(File: \"GameInputSvc.exe\")\n file/memory contains long string(File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"ev2c34.exe\" called \"CopyFileA\" to copy %APPDATA%\\comain_ev2c34\\bnymir.ou to new location %APPDATA%\\bnymir.ou (UID: 00000000-00004324)\n \"ev2c34.exe\" called \"CopyFileA\" to copy %APPDATA%\\comain_ev2c34\\ap.asin to new location %APPDATA%\\ap.asin (UID: 00000000-00004324)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\ (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter C:\\Users (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\nsmE384.tmp (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\comain_ev2f79 (UID: 00000000-00005580)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005580)\n \"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002008)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134306764135974034.4248.DefaultAppDomain.powershell\" - (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"tasklist.pdb\"\n \"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Source: 36883-256-00AE4615, Indicator: \"select name from win32_service where processid = %d and state=\"running\"\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Source: 36883-305-00AE2E12, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process\")\n \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Proces\" (Source: 00000000-00007100-00002714-3258471809, Indicator: \"select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_proces\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"nsExec.dll\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00007100-36883-143-00AEED50\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00002196-45183-309-00A2969E\n WaitForSingleObject@KERNEL32.DLL at 00000000-00002196-45183-478-00A14873\n WaitForSingleObject@KERNEL32.DLL at 00000000-00002196-45183-541-00A142F8\n WaitForSingleObject@KERNEL32.DLL at 00000000-00002196-45183-562-00A14350\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004324-46009-309-013A969E\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004324-46009-478-01394873\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004324-46009-541-013942F8\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004324-46009-562-01394350","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00007100-36883-332-00AE218B\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002196-45183-514-00A126C9\n LoadLibraryExA@KERNEL32.DLL at 00000000-00002196-45183-752-00A2BB73\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004324-46009-514-013926C9\n LoadLibraryExA@KERNEL32.DLL at 00000000-00004324-46009-752-013ABB73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005580-00000C46-2227862546\")\n Found string \"cmd.exe /C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\\nD:\\\nF:\\\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005580-00000C46-15384330261\")\n Found string \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\\nD:\\\nF:\\\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsExec.dll\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3f","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\" (UID: 00000000-00004248)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$41","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mode.richq.rdata@.rsrc.rdata.rdata\"\n Pattern match: \"data@.rsrcb.relockbdsmsfi.dllkbdlayerdescriptorrsdskbdsmsfi.pdbgctl.text\"\n Pattern match: \"data@.rsrcb.relockbdiulat.dllkbdlayerdescriptorrsds\"\n Pattern match: \"data@.rsrcb.relockbdne.dllkbdlayerdescriptorrsdsrkbdne.pdbgctl.text\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134306764135974034.4248.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71010000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6FCA0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Drv_ceo_12.8.1_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B80000\n \"Drv_ceo_12.8.1_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73150000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B80000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B80000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73150000\n \"findstr.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B80000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B80000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73150000\n \"ev2f79.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B80000\n \"ev2c34.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76B80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 724F0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Drv_ceo_12.8.1_x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 741F0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 741F0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 741F0000\n \"findstr.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 741F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 741F0000\n \"ev2f79.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 741F0000\n \"ev2c34.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 741F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"15001500f22502100000000000002c74@ADVAPI32.dll\"\n \"140014000a2602100000000000002c74@ADVAPI32.dll\"\n \"12001200222602100000000000002c74@ADVAPI32.dll\"\n \"15001500382602100000000000002c74@ADVAPI32.dll\"\n \"10001000502602100000000000002c74@ADVAPI32.dll\"\n \"0e000e00642602100000000000002c74@ADVAPI32.dll\"\n \"0c000c00762602100000000000002c74@ADVAPI32.dll\"\n \"13001300862602100000000000002c74@ADVAPI32.dll\"\n \"140014009c2602100000000000002c74@ADVAPI32.dll\"\n \"0d000d00b42602100000000000002c74@ADVAPI32.dll\"\n \"10001000540b02100000000000006975@SHELL32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"powershell_ise.exe\" (Indicator: \"powershell_ise.exe\"; Source: \"00000000-00004248.00000000.272896.05330000.00000004.mdmp\")\n Found string \"$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath\" (Indicator: \"Resolve-Path\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")\n Found string \"if(Test-Path -LiteralPath $filePath -PathType Container)\" (Indicator: \"Test-Path\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$45","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00005580-00000BC0-3257345691]\n Observed system executable string:\"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00002008-00000C47-405082474]\n Observed system executable string:\"%WINDIR%\\system32\\findstr.exe\" [Source: 00000000-00002008-00000C47-427132112]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\tasklist.exe\" [Source: 00000000-00002008-00000BC0-3257727826]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\findstr.exe\" [Source: 00000000-00002008-00000BC0-3257738132]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00000312-00000C47-406792854]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002280-00000C47-502557786]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002280-00000BC0-3263632626]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00002008) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00002008) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"tasklist.exe\" (UID: 00000000-00007100) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00000312) was launched with missing environment variables: \"PROMPT\"\n Process \"cmd.exe\" (UID: 00000000-00002280) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"ev2f79.exe\" (UID: 00000000-00002196) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$46","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00002008)\n Spawned process \"tasklist.exe\" (UID: 00000000-00007100)\n Spawned process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00006452)\n Spawned process \"cmd.exe\" with commandline \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -Exclusio ...\" (UID: 00000000-00000312), Spawned process \"cmd.exe\" with commandline \"/C \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\"\" (UID: 00000000-00002280), Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\" (UID: 00000000-00004248), Spawned process \"ev2f79.exe\" (UID: 00000000-00002196), Spawned process \"ev2c34.exe\" (UID: 00000000-00004324)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00002008)\n Spawned process \"tasklist.exe\" (UID: 00000000-00007100)\n Spawned process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00006452)\n Spawned process \"cmd.exe\" with commandline \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -Exclusio ...\" (UID: 00000000-00000312), Spawned process \"cmd.exe\" with commandline \"/C \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\"\" (UID: 00000000-00002280), Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\" (UID: 00000000-00004248), Spawned process \"ev2f79.exe\" (UID: 00000000-00002196), Spawned process \"ev2c34.exe\" (UID: 00000000-00004324)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Drv_ceo_12.8.1_x64.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ev2f79.exe.nhpart_eca71a8195ce\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ev2c34.exe.nhpart_2d004296fcc8\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"vulkan-1-32.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Drv_ceo_12.8.1_x64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nshE316.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(File: \"mountmgr.sys\")\n file/memory contains long string(File: \"volmgr.sys\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"function New-Guid\" (Indicator: \"New-Guid\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"System.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00000000-00007100-36883-291-00AE707D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"tasklist.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"ev2f79.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"ev2c34.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$48","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nshE316.tmp\" has type \"Unknown\" - Location: [%TEMP%\\nshE316.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$4a","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Drv_ceo_12.8.1_x64.exe\" queries basic process information of the \"C:\\Drv_ceo_12.8.1_x64.exe\" (UID: 5580)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Drv_ceo_12.8.1_x64.exe\" reads file \"c:\\drv_ceo_12.8.1_x64.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4c","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Drv_ceo_12.8.1_x64.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Drv_ceo_12.8.1_x64.exe\" trying to touch file \"C:\\DRV_CEO_12.8.1_X64.EXE.LOCAL\"\n \"Drv_ceo_12.8.1_x64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"Drv_ceo_12.8.1_x64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Drv_ceo_12.8.1_x64.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleaut32.dll\"\n \"Drv_ceo_12.8.1_x64.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"ev2f79.exe\" touched file \"C:\\Program Files (x86)\\Microsoft\"\n \"ev2f79.exe\" touched file \"C:\\Program Files (x86)\\Microsoft\\Temp\"\n \"ev2f79.exe\" touched file \"C:\\Program Files (x86)\\Microsoft\\Temp\\EU8BE.tmp\"\n \"ev2c34.exe\" touched file \"C:\\Program Files (x86)\\Microsoft\"\n \"ev2c34.exe\" touched file \"C:\\Program Files (x86)\\Microsoft\\Temp\"\n \"ev2c34.exe\" touched file \"C:\\Program Files (x86)\\Microsoft\\Temp\\EU15DD.tmp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Drv_ceo_12.8.1_x64.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Drv_ceo_12.8.1_x64.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Drv_ceo_12.8.1_x64.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nshe316.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Able to download payload via Wget","description":"file/memory contains long string(File: \"shgina.dll\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-963","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"PSHED.DLL\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Contains Wi-Fi native api calls","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1016.002","relevance":1,"id":"string-740","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"PeekNamedPipe\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; File: \"JHI.dll\")\n file/memory contains long string with (Indicator: \"wsastartup\"; File: \"JHI.dll\")\n file/memory contains long string with (Indicator: \" send \"; File: \"JHI.dll\")\n file/memory contains long string with (Indicator: \" shutdown \"; File: \"ipmiprv.dll\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000001.274074.03320000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000001.274074.03320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00004248\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"TikTok Installer.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005580\"\n YARA signature for encryption algorithm file \"NetPeerDistCim.dll\"\n YARA signature for encryption algorithm file \"SettingSyncCore.dll\"\n YARA signature for encryption algorithm file \"wdsutil.dll\"\n YARA signature for encryption algorithm file \"odbc32.dll\"\n YARA signature for encryption algorithm file \"DAFWSD.dll\"\n YARA signature for encryption algorithm file \"TtlsAuth.dll\"\n YARA signature for encryption algorithm process \"00000000-00007100\"\n YARA signature for encryption algorithm file \"directxdatabaseupdater.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002196-45183-486-00A128DA\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00004324-46009-486-013928DA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE2421EC49087E285A4635AEA6A4B4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000001.274074.03320000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE47F2906344E81E0083EF1CB47BE7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004248.00000001.274074.03320000.00000004.mdmp, 00000000-00004248.00000001.274074.07C0F000.00000004.mdmp, 00000000-00004248.00000001.274074.08E61000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004248.00000000.272896.03300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsmE384.tmp (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsmE384.tmp\\nh_eca71a8195ce.nhc (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsmE384.tmp\\nh_8b7dd226f6f2.nhc (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsmE384.tmp\\nh_7529123106ed.nhc (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsmE384.tmp\\nh_39f7b8fb60cd.nhc (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsmE384.tmp\\nh_d759ea87c9f5.nhc (UID: 00000000-00005580)\n \"Drv_ceo_12.8.1_x64.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsmE384.tmp\\nh_2d004296fcc8.nhc (UID: 00000000-00005580)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Drv_ceo_12.8.1_x64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ev2f79.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ev2f79.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"ev2c34.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ev2c34.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004248)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004248)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00004248.00000001.274074.07C0F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \" tasklist \") in Source: 00000000-00005580-00000C46-2227862546\n Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00002008-00000C47-405082474]\n Observed string: \"%WINDIR%\\SysWOW64\\tasklist.exe\" [Source: 00000000-00002008-00000BC0-3257727826]\n Observed string: \"tasklist.exe\" [Source: 00000000-00007100-00000BC0-3257808438]\n Observed string: \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \" tasklist \") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"System.dll\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"nsExec.dll\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"nsExec.dll\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"IsUserAnAdmin@SHELL32.DLL at 00000000-00002196-45183-523-00A125D9\n IsUserAnAdmin@SHELL32.DLL at 00000000-00004324-46009-523-013925D9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00005580-00000C46-2227862546\")\n Found string \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00002008-00000C47-427132112\")\n Found string \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00004248.00000001.274074.07BC0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00004248.00000001.274074.07BC0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00004248.00000001.274074.07BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains system command string that can search for a specific process","description":"Observed string: \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" [Source: 00000000-00005580-00000C46-2227862546]\n Observed string: \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" [Source: cmd.exe]","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-172","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"tasklist\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" Win32_Service\"; File: \"00000000-00007100.00000000.272518.00AE1000.00000020.mdmp\")\n Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; File: \"00000000-00007100.00000000.272518.00AE1000.00000020.mdmp\")\n Found string \"ame FROM Win32_Service WHERE ProcessId = %d and State=\"Running\"\" (Indicator: \" Win32_Service\"; File: \"00000000-00007100.00000000.272518.00AE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00006452)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in file \"Drv_ceo_12.8.1_x64.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"Drv_ceo_12.8.1_x64.exe\"\n Found registry deletion API: \"RegDeleteKeyExA\" in file \"Drv_ceo_12.8.1_x64.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007100)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004248)\n \"ev2f79.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002196)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002196.00000000.273033.02E70000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004248.00000000.272896.03300000.00000004.mdmp, 00000000-00004248.00000001.274074.03320000.00000004.mdmp\")\n Found string \"2\\drivers\\SandboxFilter.sys\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00004248.00000000.272896.03940000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00004248.00000000.272896.03300000.00000004.mdmp\n 00000000-00004248.00000001.274074.03300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"nsExec.dll\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp, 00000000-00002196.00000000.273033.04C80000.00000040.mdmp, 00000000-00002196.00000000.273033.1001D000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004248.00000001.274074.00C61000.00000002.mdmp, 00000000-00004248.00000001.274074.6F515000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Drv_ceo_12.8.1_x64.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\" (UID: 00000000-00004248)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Drv_ceo_12.8.1_x64.exe\")\n Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; File: \"Drv_ceo_12.8.1_x64.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00004248.00000000.272896.06330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002196.00000000.273033.00A2C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5e","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Drv_ceo_12.8.1_x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"ev2f79.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ev2c34.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4248)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/23 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Drv_ceo_12.8.1_x64.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Drv_ceo_12.8.1_x64.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Drv_ceo_12.8.1_x64.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Drv_ceo_12.8.1_x64.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Drv_ceo_12.8.1_x64.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Drv_ceo_12.8.1_x64.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Drv_ceo_12.8.1_x64.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$61","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$62","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete volume snapshots","description":"file/memory contains long string(File: \"volmgr.sys\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-634","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"00000000-00007100.00000000.272518.00AE1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$63","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$64","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@NTDLL.DLL at 00000000-00007100-36883-267-00AE49CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00007100)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"$65","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Drv_ceo_12.8.1_x64.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\comain_ev2f79\\ev2f79.exe\" (Handle: 788)\n \"Drv_ceo_12.8.1_x64.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\comain_ev2c34\\ev2c34.exe\" (Handle: 764)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\tasklist.exe\" (Handle: 448)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\findstr.exe\" (Handle: 444)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 420)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"PlugXBootLDRCode\" classified process \"00000000-00004324\" as \"plugx\"\n YARA signature \"PlugXBootLDRCode\" classified process \"00000000-00002196\" as \"plugx\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"Drv_ceo_12.8.1_x64.exe\" (UID: 00000000-00005580)\n Spawned process \"cmd.exe\" with commandline \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00002008)\n Spawned process \"tasklist.exe\" (UID: 00000000-00007100)\n Spawned process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00006452)\n Spawned process \"cmd.exe\" with commandline \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\"\" (UID: 00000000-00000312)\n Spawned process \"cmd.exe\" with commandline \"/C \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\"\" (UID: 00000000-00002280)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\" (UID: 00000000-00004248)\n Spawned process \"ev2f79.exe\" (UID: 00000000-00002196)\n Spawned process \"ev2c34.exe\" (UID: 00000000-00004324)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":128,"dropped_files_count":0,"extracted_files_count":82,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["plugx","ransomware","evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a774a8fa4ec669b00045471","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware_","submit_name":"Drv_ceo_12.8.1_x64.exe","analysis_start_time":"2026-08-08T15:26:11+00:00","indicators_count":{"informative":229,"suspicious":69,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}],"processes":[{"pid":5580,"ppid":0,"name":"Drv_ceo_12.8.1_x64.exe","command_line":"","sha256":"0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5","normalized_path":"C:\\Drv_ceo_12.8.1_x64.exe","uid":"00000000-00005580","icon":"$66"},{"pid":2008,"ppid":5580,"name":"cmd.exe","command_line":"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005580","uid":"00000000-00002008"},{"pid":7100,"ppid":2008,"name":"tasklist.exe","command_line":"","sha256":"cc87ad2c2a96507d33a0a7e09f1e42d19c7e2aa26a4071a4d8e9dd096ebcf33e","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00000000-00002008","uid":"00000000-00007100"},{"pid":6452,"ppid":2008,"name":"findstr.exe","command_line":"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"","sha256":"3a325a8337486df63a0ce02de757a5bc417fa7f9ab6f62d8f46b9be54766fc01","normalized_path":"%WINDIR%\\SysWOW64\\findstr.exe","parent_uid":"00000000-00002008","uid":"00000000-00006452"},{"pid":312,"ppid":5580,"name":"cmd.exe","command_line":"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\,D:\\,F:\\\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005580","uid":"00000000-00000312"},{"pid":2280,"ppid":312,"name":"cmd.exe","command_line":"/C \"powershell Add-MpPreference -ExclusionPath C:\\,D:\\,F:\\\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00000312","uid":"00000000-00002280"},{"pid":4248,"ppid":2280,"name":"powershell.exe","command_line":"powershell Add-MpPreference -ExclusionPath C:\\,D:\\,F:\\","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002280","uid":"00000000-00004248"},{"pid":2196,"ppid":5580,"name":"ev2f79.exe","command_line":"","sha256":"58b5185a7c1c4b22846cc19a2b67ffe62f1dc3e72c0c6d9f1026579a44ad6e97","normalized_path":"%APPDATA%\\comain_ev2f79\\ev2f79.exe","parent_uid":"00000000-00005580","uid":"00000000-00002196"},{"pid":4324,"ppid":5580,"name":"ev2c34.exe","command_line":"","sha256":"d80c12abd623a0614e09163687fa73cb327d756749c1d18563cd1e1dd7d7b31d","normalized_path":"%APPDATA%\\comain_ev2c34\\ev2c34.exe","parent_uid":"00000000-00005580","uid":"00000000-00004324"}],"all_imported_dlls":["msvcp140.dll","framedynos.dll","System.Transactions.dll","OpcServices.dll","wininet.dll","rsaenh.dll","Microsoft.PowerShell.Commands.Management.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wmidcom.dll","IPHLPAPI.DLL","user32.dll","advapi32.dll","mscoreei.dll","Mf9fIBw6.dll","System.Data.dll","miutils.dll","oleacc.dll","System.dll","wbemsvc.dll","Microsoft.AppV.AppVClientPowerShell.dll","winnsi.dll","ucrtbase.dll","profapi.dll","ws2_32.dll","wbemprox.dll","clrjit.dll","msisip.dll","apphelp.dll","wintrust.dll","msasn1.dll","KernelBase.dll","powrprof.dll","System.Management.Automation.dll","imagehlp.dll","xmllite.dll","win32u.dll","combase.dll","gdi32full.dll","msvcrt.dll","oleaut32.dll","fastprox.dll","Microsoft.PowerShell.ConsoleHost.dll","shell32.dll","bcryptprimitives.dll","mscorlib.ni.dll","ntdll.dll","System.Configuration.Install.dll","mpr.dll","comctl32.dll","setupapi.dll","atl.dll","System.Core.ni.dll","psapi.dll","propsys.dll","mscoree.dll","cryptnet.dll","Microsoft.BitLocker.Structures.dll","dpapi.dll","wow64cpu.dll","windows.storage.dll","dwmapi.dll","clr.dll","crypt32.dll","slc.dll","vcruntime140.dll","bcrypt.dll","System.Xml.ni.dll","SHCore.dll","wshext.dll","MpClient.dll","version.dll","shfolder.dll","Microsoft.Management.Infrastructure.ni.dll","wldp.dll","wow64.dll","gdi32.dll","netutils.dll","gpapi.dll","sspicli.dll","sechost.dll","sppc.dll","clbcatq.dll","cfgmgr32.dll","uxtheme.dll","userenv.dll","System.Configuration.ni.dll","mi.dll","wow64win.dll","kernel32.dll","rpcrt4.dll","dbghelp.dll","System.Numerics.dll","cryptbase.dll","vcruntime140_clr0400.dll","System.ni.dll","System.Management.dll","shlwapi.dll","msIso.dll","msvcp_win.dll","ole32.dll","winsta.dll","pwrshsip.dll","Microsoft.AppV.AppvClientComConsumer.dll","wbemcomn.dll","MpOAV.dll","urlmon.dll","fltLib.dll","System.DirectoryServices.dll","Microsoft.PowerShell.Security.dll","nsi.dll","Microsoft.Management.Infrastructure.Native.dll","ntmarta.dll","WindowsCodecs.dll","amsi.dll","Microsoft.PowerShell.Commands.Utility.dll","imm32.dll","VxSSL32.dll","cryptsp.dll","ucrtbase_clr0400.dll","kernel.appcore.dll","IconCodecService.dll","srvcli.dll","secur32.dll","coml2.dll","AppxSip.dll","wmiutils.dll","iertutil.dll","normaliz.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ev2c34.exe.nhpart_2d004296fcc8","sha256":"d80c12abd623a0614e09163687fa73cb327d756749c1d18563cd1e1dd7d7b31d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"ev2f79.exe.nhpart_eca71a8195ce","sha256":"58b5185a7c1c4b22846cc19a2b67ffe62f1dc3e72c0c6d9f1026579a44ad6e97","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"TikTok Installer.exe","sha256":"00cdbe1969dc351f75226d3818f2c64db585b8bb7947eea896edfa972c69e498","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Intel_OpenCL_ICD64.dll","sha256":"7f9c6eebacb4dd33f3806c98f0b066e6c78e0925ec74e8527d4df0ee122bb62a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"NetPeerDistCim.dll","sha256":"aaef07fd447dcb34f9df99f69dd7decfd09f9b985ccc42209b666b30c370d58b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"SettingSyncCore.dll","sha256":"f92a198c27162b1715fa0abdfc216be4a9b962e70872ac4cd0d86138065ca71c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Windows.Gaming.XboxLive.Storage.dll","sha256":"3f40b8d34270c71c66a152ead916bc3d11e4a711ac2ea73aad2ea84285d321a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"WpdMtpDr.dll","sha256":"83bd62d9144a08111c6abe5f8115a6e9e16a1215d25462e4a0bab22daf7197e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"directxdatabaseupdater.exe","sha256":"4e83fbaf142d1955b550ab3b11a4b361bd9ffb856869bf293697a27dec0ae784","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"es.dll","sha256":"69d13f4c689f738faebe4694b9ee6fc9f05cae745140facac08ffdfd89e1bd70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"gdi32full.dll","sha256":"724754c47bcd7a2739816c7cefbc75382515538a15ccb73a8342043a16453772","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"igfxDIN.dll","sha256":"2108ca999edb6c97322f7ab40617393fe5e70a4d99c4f2eee8031527aedf09f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"mdmregistration.dll","sha256":"7081806d75ed1f72e51fe96fe436980f8a27d81f37b45959cf82db6a9b1520a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"odbc32.dll","sha256":"b70a6881a7954c2a0caf86197cc908410bc3bed6e9f6b5d28bc3a91a1508788b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"pdh.dll","sha256":"e318b07d532992c0498364825474ae0f1b1d48e63552c8e1261d643d61c665c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"smartscreenps.dll","sha256":"a04892b57e9fbf2dc744502f1d5e0c8b42d42400af9e71d91813065b00a819dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"vulkan-1-32.dll","sha256":"8a67219bd2fa98944b6627b806cc1c6dea36924c234f37cffbdaa19524f47901","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"vulkan-1.dll","sha256":"ae474d5085c64c5349702eb1d38eebd1f3b1bf085b4585bb23936f1596cdcc6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"wdsutil.dll","sha256":"58af2ff9e6cf79162cadca53886fd72ddca83cdbe0be720dd2272ff406e6c5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"bnymir.ou","sha256":"80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"BTHPRINT.SYS","sha256":"2f0296d7b2d4b715c0c8861f81b49e2d2a978aeb7a130b685d0e9876014bad6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"DAFWSD.dll","sha256":"707a3e550aa621eeab012c7522fa647add22239ea10c5a024476d900a55d5528","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"JHI.dll","sha256":"1418fa485b024d21c829c8c81dec58a48a0fdf1b46c122ca95daf695da42a74e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"KBDIULAT.DLL","sha256":"d164ab84aa021a002315d2ca0b711a5ea2d8044b9473b26c218d834449c3920d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"KBDNE.DLL","sha256":"da3fcc069a9ee56095bd0ae58baca5a6eb12e6e92a5b89a7c4ecf7291d7dac63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"KBDSMSFI.DLL","sha256":"e127672cab2106fc6824de233daf056142d889a7323779fd871ea9b41e7477cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"PCL5URES.DLL","sha256":"2de65a838935b16aefb774d581807b575b6861d2a6a8d69e1ab44efc6e74d661","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"PSHED.DLL","sha256":"27858972c18afccd944453b72feeeba66b1587f2075087780aa4fc54202d8221","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"RjvPlatform.dll","sha256":"802932a146effd0f26b9760005ec4a1d4f575df9904187187dbcc159853b69e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"TableTextServiceMig.dll","sha256":"cdaf2b3e2cfa28924d2ed1617b84567aca6854ae6ecf082f699b08f734702c4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"TtlsAuth.dll","sha256":"2d7d480faab024e65cdcffba2ee98126beef8ce08a58acf47a1f3b5323ba64e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"W32UIRes.dll","sha256":"9a88918f3d0d0b651eff4218b1b6461cae1949be1842f21eff39dfc5e506c4e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"api-ms-win-core-stringloader-l1-1-1.dll","sha256":"2b600754557f102653c05308b5fc8bdca2aef8086667f2f7414fdb5bd0e9060b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"dllhost.exe","sha256":"0309834d40475ccd5a88c48f7ff5ec62e5c6798900357dd83665c3d0345124e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"kernel.appcore.dll","sha256":"abff38d9efaca07602acc2a31775f8790ac720261842dbb6d7d9e1a46bba91f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"mferror.dll","sha256":"f750e1dbf57a85ea150238f69f7ba672d7f60a764226a76f6ea7ce7c5009aa70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"msaudite.dll","sha256":"f7ce700504ddc4111dcbb7ad57467f4656d0adfe67cd7229d3ada6c223fab3ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"msdtcstp.dll","sha256":"5868630df2430625d7f62f52be69da6935bb0c7a213f80a996f21a3d034285b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"wermgr.exe","sha256":"284f38524c26f39b1dd788210e7310c8df99efe8a420a031dc42247e75fc646e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"ap.asin","sha256":"156fb419996462ba4024e6c60fa36c4e240b3d6bf68a31a99cc636083ee17635","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"ap.asin.nhpart_c03f8c02ae29","sha256":"156fb419996462ba4024e6c60fa36c4e240b3d6bf68a31a99cc636083ee17635","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"bnymir.ou.nhpart_419feabca584","sha256":"80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"bteuns.pt.nhpart_ce727a6be914","sha256":"29fbb5abc68c1c3f912500670f2ceb41b4ba3a9bf6af9c9a681aedfa7eb8e279","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"cmrsk.ce.nhpart_809b48356e46","sha256":"2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"fhkan.oi.nhpart_393638b58a58","sha256":"d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"dxyvnb.ti.nhpart_d759ea87c9f5","sha256":"700f323400cebc41c77236144b8ed387acb93bfbef64a40af4faf12df8ce2cff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"ntrin.er.nhpart_8b7dd226f6f2","sha256":"6311d46495b54c0bbb3b1ce2962eaeca90e5bc7fb49fadead9d3dac1a2a61fb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"otrm.oi.nhpart_7529123106ed","sha256":"cad3a6119836f449186774952891d78502213c894904eb3b2892fd3d0545a191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"yinma.vc.nhpart_39f7b8fb60cd","sha256":"5427d1ffdbc7ecd5daf28c73a4402a831a713cc414d9b5a3d7684cc7a7933538","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"StartupProfileData-NonInteractive","sha256":"b32f7fc66f09c2f896dab65fad1370c9b5b3dd71ca70663f44d2d5b8ae5f8270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"nshE316.tmp","sha256":"9f8017b369b33eb3a374fc4ea61c5321f7a30bd06e614902e36a97d4e4cae50a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"AppListBackupLauncher.dll","sha256":"0eceeddce1fa42c5cca00c1669d68360436ed8ad9fa6629565950b455aa8c81c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Apphlpdm.dll","sha256":"52a99f5c7b4cecf5c8d529f4ffcf2743fd1a7a6773ffbe4c571eaad8e2394328","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"DscTimer.dll","sha256":"c46777082581a67cde57df6d085a0d5c67505af383e4e129ca2f8398e647c748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"EsclWiaDriver.dll","sha256":"fb23b2d96a65c4eab485d04bae4438a2c091393d928f6fe38241c32dffce0d0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"GameInputSvc.exe","sha256":"49a635bdfa1b075f27fb408135c0a7e243e5bd4375670b86e163cda93dbbd670","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"GamePanelExternalHook.dll","sha256":"0a45756ec0416cffaa70a99cf8fbcf5bdc70111ac6027708da58f6183e78d080","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"LangCleanupSysprepAction.dll","sha256":"64464673e6f53f103407a98a051052072442c6b6af57914a077949d17690193a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"MitigationConfiguration.dll","sha256":"a44cd3b7d2ca1b78afc21e68244537cab39bcddd94bb384f12b8a855a9944037","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"PresentationHost.exe","sha256":"17d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"RDCameraMediaSource.dll","sha256":"9a7075b0e0c32445a85bebf70532bece9ec7fe227363e54a482876b4afb239cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"StorFwUpdate.dll","sha256":"c4e27ee8f134380728a2d5f0326f561d2c142c4695d5fe1d4ccdb1feb894f0a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"SyncInfrastructureps.dll","sha256":"94968c4f0473fe4233bd05a5950384e88275d5b37cb720a44188fcfcc91fa0c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"WinMgmt.exe","sha256":"5f01cfea2e7e4e37dbf0e3300359d83cb08f0082aab2d22d0846d59d32bf4be2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Windows.Media.Streaming.ps.dll","sha256":"dece3a340b47cb33696fa6fecaf57a74456fa75a7e17acbea63535c5c516f7a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"WlanRadioManager.dll","sha256":"7b7b3b275a9a04e6e9f9b4ec02953ea7d6f8cf557424931f424548a87adcc149","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"coreaudiopolicymanagerext.dll","sha256":"6fcea7d8ad90cac35b4f37f2e2d0a73955f3cfe0f3ccfb5e09c58f46c35ea066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"fhshl.dll","sha256":"1a8e024755247d9086a8c111bdb984d35afc3a772f51d65f946f7a9b410f12ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"fsutilext.dll","sha256":"9efa8578eb79a0f6f1ca31126839f830e1727bc8a9b74e482f11c118b9125718","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"internetmail.dll","sha256":"3f27c311cd981c6c3b2e36f6879ad57c2ffff4c716b7196cf8d0dbd524908aa6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"ipmiprv.dll","sha256":"d528fa678e6b34dd13154dc1501b4fe5592dda8e6ba8732bd3de17d2b2719b2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"msoobewirelessplugin.dll","sha256":"a15874dc418b9cb01f4c7083868e676b8ea14cd2ba16dbae7bea87b4223bce1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"netfxperf.dll","sha256":"38c384c473a5d9e89f933b0df676629e2ab79240a0c84f2a78f40e50d87ae2c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"psmsrv.dll","sha256":"9f20be3de878d072e4e090ac9e06df7a216d21d7847474150b160e722c6665a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"sethc.exe","sha256":"7b58305c6200e683af425a8fca93fcfcaa181a853529ae67bb368804ffe44ee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"shgina.dll","sha256":"6d35b6416486efb0c5ab2d10e4ac0b76320cc7a6caa76db7c9f35e8be8b8216a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"tcpmonui.dll","sha256":"5752f3c7d0494bd7bd5094016fbefc66283d4007e89e2e27b74a7774353a2644","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"tssysprep.dll","sha256":"8a4a57504dfa79e4548e8b10c603c82c078030498527f37a36883114a940dbd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"wsmprovhost.exe","sha256":"3f024e4b57c2606a3ffc9a98b22a895adb6d173e87af6037fde16d6df640488e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"System.dll","sha256":"a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"nsExec.dll","sha256":"b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nsxE2D7.tmp","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nshE316.tmp","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nsmE384.tmp","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nsmE384.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%APPDATA%\\comain_ev2f79","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nsmE384.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nsmE384.tmp\\nh_eca71a8195ce.nhc","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%APPDATA%\\comain_ev2f79\\ev2f79.exe.nhpart_eca71a8195ce","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nsmE384.tmp\\nh_8b7dd226f6f2.nhc","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%APPDATA%\\comain_ev2f79\\ntrin.er.nhpart_8b7dd226f6f2","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\nsmE384.tmp\\nh_7529123106ed.nhc","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_m1udahpl.nia.ps1","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jhcwhabl.f4l.psm1","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU8BE.tmp","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\se_tmp.txt","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Temp\\EU15DD.tmp","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%TEMP%\\uk_tmp.txt","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%APPDATA%\\bnymir.ou","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"path":"%APPDATA%\\ap.asin","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Local\\SM0:5580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"SM0:5580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"SM0:7100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Local\\SM0:4248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"SM0:4248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"Local\\SM0:4248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"SM0:4248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a774a8fa4ec669b00045471"}]}]}},"report_ids":{"sandbox_job_ids":["6a774a8fa4ec669b00045471"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware_ Sample 0d4755125431… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0d4755125431…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware_ Sample 0d4755125431… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0d4755125431…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware_ Sample 0d4755125431… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0d4755125431…. Malware family: Malware_. Threat score 100/100. 1/23 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L67","11",{}]]