Steam Community :: s37h https://128.140.125.116|

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T496,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jalapeno.Generic Sample 0de96b70e1e2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0de96b70e1e2…. Malware family: Jalapeno.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","keywords":["Malicious","Jalapeno.Generic","malware analysis","sandbox report","threat intelligence","0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jalapeno.Generic","antivirusDetections":{"malicious":18,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T555,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp")28:T6de,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00002068.00000814.5564395.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00002068.00000814.5564395.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00002068.00000814.5564395.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "00002068.00000814.5564395.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp")29:T109e,Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to "ryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "ryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002068-00000CC3-576313576") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp")2a:Tfcf,Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002068-4653-13-00417770 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-13-00417770 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002068-4653-37-0040F8DE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-126-0041795F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-126-0041795F Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00002068-4653-299-004190D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-299-004190D0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002068-4653-304-00417C00 Assembly shows XOR instruction xor ebx dword ptr [ecx] in Stream UID: 00000000-00002068-4653-304-00417C00 Assembly shows XOR instruction xor esi dword ptr [0042B1B0h] in Stream UID: 00000000-00002068-4653-307-004177D0 Assembly shows XOR instruction xor ecx dword ptr [eax+edi] in Stream UID: 00000000-00002068-4653-307-004177D0 Assembly shows XOR instruction xor ecx dword ptr [edx+edi] in Stream UID: 00000000-00002068-4653-307-004177D0 Assembly shows XOR instruction xor ecx dword ptr [ebp+0Ch] in Stream UID: 00000000-00002068-4653-325-0041BDB3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-348-00419A14 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-348-00419A14 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-355-004197E7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-355-004197E7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-359-00418B98 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-359-00418B98 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-360-0041A65A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-360-0041A65A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-363-00418AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-363-00418AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-364-0041A109 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-364-0041A109 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-373-00416F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-373-00416F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-376-00418DFB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-376-00418DFB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-385-0041747D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-385-0041747D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-387-0041753E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-387-0041753E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-395-00417E22 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-395-00417E22 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002068-4653-397-004180D4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002068-4653-397-004180D4 Assembly shows XOR instruction xor eax 0062C2C4h in Stream UID: 00000000-00002068-4653-494-004106F7 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002068-4653-589-004196F5 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002068-4653-633-004196B0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002068-4653-635-00417C902b:T82b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2c:T441,Found XOR loop in file "sample.bin" at offset 104518; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 233291; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 268069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 287230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 307587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 339998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 341976; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 201511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 255415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 330480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 335003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 346904; code bytes = 80302d:Td6e,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002300cc41297760853b00a0000000fe030000ff2b28779bb40477940000002402360000003600320016000100000000000000000000001300000001000000330002000100000004000000010000000000000000000000086d3600f81f0000940000000000000000000000c0ed3900f8693600546b360078853b00d8743600000000006cf223000000000030f8230095e124777b5a0f00feffffffff2b28779a2a287794000000b4f32300fdfe3e7794ec23000100000030f82300a2e0ec69dff360cafeffffff4cf323005c9cec695c0c000060f323006f9cec690000000000000000 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000360014000000aa000000000000000000000048b73d00f8693600606b3600a01b3f0010763600650067008cddc5006d002e0094eac500a01b3f00e9e92877a01b3f0000000000aa000000b8dec500f0e2c500000000000000000000000000000000000000000000000000801a0000000036001c5c277760d83275ffffffff1700000068dec500240000000300000058e3c50084e8c500f0e2c5008600000094dec50096ed2877c21b3f00a06afe7486000000b8dec500f0e2c5000000000086008800a06afe74b8dec500916cfe74c21b3f00a06afe74a06afe7428e3c50002020000 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003404)2e:T610,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000030002c0030002c002c006400340063000d000a00000065006c00330032002e0064006c006c002c0022003200350032003a00310031003a00330035002e0035003000370022002c00520058003d0030002c00500058003d00300000003000300030003000300062003100310064003000 (UID: 00000000-00003404) "RegAsm.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002068) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002068) "RegAsm.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3b76b8c1320100f0fd7f9a5c297700e0fd7fc880140044f0fd7f00000000400000003f0000002400000000f0fd7fbc801400c15c2977608230772400000000f0fd7f9a5c297700e0fd7fe0801400578928778083307713173375d8eb3b76 (UID: 00000000-00002068)2f:T2b48,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003404) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00002068) "RegAsm.exe" called "LoadLibrary" with a parameter OLEAUT32 (UID: 00000000-00002068)30:Te4d8,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003404) "RegAsm.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateDCA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemPowerStatus (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CloseWindow (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CharToOemW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StrCmpCA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StrCmpCW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SymMatchString (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NSPStartup (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DnsQueryConfigAllocEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DnsNameCompare_W (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DnsApiAlloc (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DnsQueryExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentThreadCompartmentId (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSAttemptAutodialAddr (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSAttemptAutodialName (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSNoteSuccessfulHostentLookup (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DnsApiFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeSecurityContextA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSChannelInterface (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter QueryContextAttributesA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter HTTPSCertificateTrust (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter HTTPSFinalProv (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SealMessage (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter UnsealMessage (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToProxyStubCLSID (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToTLBPath (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BSTR_UserSize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BSTR_UserMarshal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BSTR_UserUnmarshal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter BSTR_UserFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VARIANT_UserSize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VARIANT_UserMarshal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VARIANT_UserUnmarshal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter VARIANT_UserFree (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserSize (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserMarshal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserUnmarshal (UID: 00000000-00002068) "RegAsm.exe" called "GetProcAddress" with a parameter LPSAFEARRAY_UserFree (UID: 00000000-00002068)31:T486,"SELECT target_path, tab_url from downloads" (Source: 4653-169-00407898, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 4653-171-00408277, Indicator: "select service, encrypted_token from token_service") "Select * From AntiVirusProduct" (Source: 4653-235-0040F700, Indicator: "select * from antivirusproduct") "Select * From Win32_OperatingSystem" (Source: 4653-237-0040F577, Indicator: "select * from win32_operatingsystem") "Select * From Win32_OperatingSystem" (Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "Select * From AntiVirusProduct" (Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp, Indicator: "select * from antivirusproduct") "SELECT target_path, tab_url from downloads" (Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp, Indicator: "select service, encrypted_token from token_service")32:T2e75,Found reference to API (Indicator: "FreeConsole"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to API (Indicator: "CreateThread"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to API (Indicator: "VirtualProtectEx"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to API (Indicator: "LoadLibrary"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to API (Indicator: "GetProcAddress"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found reference to API (Indicator: "Sleep"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "lstrlenA"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "MessageBoxW"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "GetActiveWindow"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "GetLastActivePopup"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "HttpQueryInfoA"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "InternetSetOptionA"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003404.00000001.100256.01ADA000.00000040.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "CharToOemA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "RegGetValueA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileA"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp")33:T63b,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]34:T63d,"GET /gdroot-g2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Date: Tue 11 Aug 2026 16:39:58 GMT Content-Type: application/pkix-crl Content-Length: 584 Connection: keep-alive X-Sucuri-ID: 11032 Last-Modified: Wed 04 Mar 2026 19:34:28 GMT ETag: "248-64c37e88989ce" Cache-Control: public no-transform must-revalidate Expires: Tue 21 Jul 2026 17:15:25 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Server: Sucuri/Cloudproxy X-Sucuri-Cache: HIT Alt-Svc: h3=":443"; ma=86400 Accept-Ranges: bytes with response body ==>30C282024430C282012C020101300D06092AC28648C286C3B70D01010B050030C281C283310B30090603550406130255533110300E060355040813074172697A....... "GET /gdig2s1-66226.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Date: Tue 11 Aug 2026 16:39:58 GMT Content-Type: application/pkix-crl Content-Length: 1112 Connection: keep-alive X-Sucuri-ID: 11032 Last-Modified: Tue 11 Aug 2026 02:13:20 GMT ETag: "458-658bc03c5c013" Cache-Control: public no-transform must-revalidate Expires: Wed 12 Aug 2026 14:00:59 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Server: Sucuri/Cloudproxy X-Sucuri-Cache: HIT Alt-Svc: h3=":443"; ma=86400 Accept-Ranges: bytes with response body ==>30C282045430C282033C020101300D06092AC28648C286C3B70D01010B050030C281C2B4310B30090603550406130255533110300E060355040813074172697A.......35:T2036,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 709d0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "KERNEL32" at base 773a0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "ADVAPI32.DLL" at base 76a20000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b720000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "SHLWAPI.DLL" at base 76430000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "VERSION.DLL" at base 745d0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64ac0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "USER32.DLL" at base 76710000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "MSCOREE.DLL" at base 6b7b0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "PSAPI.DLL" at base 766c0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "RPCRT4.DLL" at base 77180000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "KERNEL32.DLL" at base 773a0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 636b0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "OLE32.DLL" at base 76560000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cc00000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69f10000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6ca70000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "NTDLL.DLL" at base 77230000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "SHELL32.DLL" at base 75730000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62c50000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62430000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" loaded module "OLEAUT32.DLL" at base 76980000 "RegAsm.exe" loaded module "KERNEL32.DLL" at base 773a0000 "RegAsm.exe" loaded module "ADVAPI32.DLL" at base 76a20000 "RegAsm.exe" loaded module "GDI32.DLL" at base 76ad0000 "RegAsm.exe" loaded module "USER32.DLL" at base 76710000 "RegAsm.exe" loaded module "CRYPT32.DLL" at base 751f0000 "RegAsm.exe" loaded module "NTDLL.DLL" at base 77230000 "RegAsm.exe" loaded module "SSPICLI.DLL" at base 74fc0000 "RegAsm.exe" loaded module "RPCRT4.DLL" at base 77180000 "RegAsm.exe" loaded module "GDIPLUS.DLL" at base 73a00000 "RegAsm.exe" loaded module "OLE32.DLL" at base 76560000 "RegAsm.exe" loaded module "BCRYPT.DLL" at base 74c50000 "RegAsm.exe" loaded module "WININET.DLL" at base 76e00000 "RegAsm.exe" loaded module "SHLWAPI.DLL" at base 76430000 "RegAsm.exe" loaded module "SHELL32.DLL" at base 75730000 "RegAsm.exe" loaded module "PSAPI.DLL" at base 766c0000 "RegAsm.exe" loaded module "RSTRTMGR.DLL" at base 6c9f0000 "RegAsm.exe" loaded module "DBGHELP.DLL" at base 6f680000 "RegAsm.exe" loaded module "SECUR32.DLL" at base 74e60000 "RegAsm.exe" loaded module "PROFAPI.DLL" at base 75140000 "RegAsm.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70330000 "RegAsm.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75430000 "RegAsm.exe" loaded module "WS2_32.DLL" at base 763f0000 "RegAsm.exe" loaded module "WINHTTP.DLL" at base 71350000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74b00000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74af0000 "RegAsm.exe" loaded module "IPHLPAPI.DLL" at base 73490000 "RegAsm.exe" loaded module "USERENV.DLL" at base 751d0000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76540000 "RegAsm.exe" loaded module "URLMON.DLL" at base 76c20000 "RegAsm.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 71c60000 "RegAsm.exe" loaded module "DNSAPI.DLL" at base 749c0000 "RegAsm.exe" loaded module "OLEAUT32.DLL" at base 76980000 "RegAsm.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "RegAsm.exe" loaded module "CLBCATQ.DLL" at base 76d70000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d080000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76540000 "RegAsm.exe" loaded module "DHCPCSVC6.DLL" at base 733a0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74660000 "RegAsm.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "RegAsm.exe" loaded module "DHCPCSVC.DLL" at base 732c0000 "RegAsm.exe" loaded module "RPCRTREMOTE.DLL" at base 750d0000 "RegAsm.exe" loaded module "RASADHLP.DLL" at base 717f0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6c570000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76980000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76e00000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733c0000 "RegAsm.exe" loaded module "COMCTL32.DLL" at base 74000000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 763f0000 "RegAsm.exe" loaded module "CREDSSP.DLL" at base 74800000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74940000 "RegAsm.exe" loaded module "NCRYPT.DLL" at base 74c70000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74810000 "RegAsm.exe" loaded module "WINTRUST.DLL" at base 75160000 "RegAsm.exe" loaded module "GPAPI.DLL" at base 74710000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76540000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76540000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 716a0000 "RegAsm.exe" loaded module "CRYPTNET.DLL" at base 716a0000 "RegAsm.exe" loaded module "SENSAPI.DLL" at base 6cc00000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 751f0000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76540000 "RegAsm.exe" loaded module "NSI.DLL" at base 76700000 "RegAsm.exe" loaded module "CFGMGR32.DLL" at base 75370000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 773a0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6daa0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6cd60000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6dca0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d30000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6c8c0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76a20000 "RegAsm.exe" loaded module "SXS.DLL" at base 75040000 "RegAsm.exe" loaded module "OLEAUT32" at base 7698000036:T4bd,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"37:T956,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003404-00000C2E-342008922] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003404-00000C2B-568980578] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003404-00000C2B-570362756] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003404-00000C2B-570532735] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003404-00000C2B-570825681] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003404-00000C2B-570906462] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003404-00000C2B-571149604] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003404-00000C2B-571644722] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003404-00000C2B-571966551] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003404-00000C2B-572251651] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003404-00000C2B-572674456] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003404-00000C2B-572769237] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00002068-00000C2B-576064964] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00002068-00000C2B-576332812] Observed system executable string:"%WINDIR%\system32\crypt32.dll" [Source: 00000000-00002068-00000C2B-576916061] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002068-00000C2B-583452545] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002068-00000C2B-583594883]38:T4fc,The input sample is signed with a certificate issued by "CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 22:66:D7:D2:99:D6:A1:56:A5:A6:D9:94:5C:88:56:DD:5C:41:8E:49; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 95:77:F9:1F:E8:6C:27:D9:91:21:29:73:0E:81:66:37:3F:C2:EE:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information)39:Td06,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\REGASM.EXE"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCOMPATIBILITY"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\REGASM.EXE"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "")3a:Tf3e,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: "DISABLEENGINE"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{A7A85EBA-A2D1-41EC-A656-BA2C9221E354}"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "{A7A85EBA-A2D1-41EC-A656-BA2C9221E354}"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLELOCALOVERRIDE"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "")3b:T42b,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe"3c:Tcfc,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\FLTLIB.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\MSVCP140.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\VCRUNTIME140.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\ucrtbase.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"3d:Tcf7,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\FLTLIB.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\MSVCP140.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\ucrtbase.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"3e:T7b5,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe.config" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Rerranged\" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.INI" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\0DE96B70E1E27FAC1FD2E2A7C61495D06D35BE71A5BD08CF1B2CCB338CDFA16B.EXE.CONFIG" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\RERRANGED" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\0DE96B70E1E27FAC1FD2E2A7C61495D06D35BE71A5BD08CF1B2CCB338CDFA16B.INI" "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "RegAsm.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.Local\"3f:T8f5,Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "00002068.00000814.5564395.00401000.wprm") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002068-00000C2C-574662444") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002068-00000C2C-574662546") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002068-00000C2C-574662761") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002068-00000C2C-574662861") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002068-00000C2C-574662966") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002068-00000C2C-574663070") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002068-00000C2C-575970143") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002068-00000C2C-575970492") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002068-00000C2C-576825446") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002068-00000C2C-577301377") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002068-00000C2C-577301726") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002068-00000C2C-577301726") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002068-00000C2C-577301726") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002068-00000C2C-577703852") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002068-00000C2C-577703852") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002068-00000C2C-577874491") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002068-00000C2C-577875020") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003404.00000001.100256.02AD0000.00000004.mdmp")40:T767f,"GET /profiles/76561199654112719 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache" "HTTP/1.1 200 OKServer: nginxContent-Type: text/html; charset=UTF-8X-Frame-Options: SAMEORIGINContent-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;Expires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Tue, 11 Aug 2026 16:39:52 GMTContent-Length: 33339Connection: keep-aliveSet-Cookie: sessionid=68f75ec13db274737dcb6b5d; Path=/; Secure; SameSite=NoneSet-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=NoneSteam Community :: s37h https://128.140.125.116|

s37h https://128.140.125.116|

Level

Currently Offline

Inventory so the line spaces like the rest -->

responsive_page_legacy_content -->

responsive_page_content -->

responsive_page_frame -->"41:Teac,"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003404) "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003404)42:T14e5,Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "FromBase64String" (Indicator: "base64"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "CryptoStream" (Indicator: "cryptostream"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "ToBase64String" (Indicator: "base64"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "System.Security.Cryptography"; File: "0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b") Found string "ryptography.AesCryptoServiceProvider" (Indicator: "aes"; File: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "ryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "" (Indicator: "base64"; File: "00002068.00000814.5564395.00401000.wprm") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003404.00000001.100256.00360000.00000004.mdmp") Found string "system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003404.00000001.100256.00360000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00003404.00000001.100256.00360000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003404.00000001.100256.00360000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003404.00000001.100256.00360000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003404.00000001.100256.00360000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003404.00000001.100256.00C82000.00000020.mdmp")43:T68e,Wrote 280 instructions to a remote process Wrote 2 instructions to a remote process Wrote 4 instructions to a remote process Wrote 36 instructions to a remote process Wrote 491 instructions to a remote process Wrote 20 instructions to a remote process Wrote 1 instructions to a remote process Wrote 11 instructions to a remote process Wrote 8 instructions to a remote process Wrote 14 instructions to a remote process Wrote 21 instructions to a remote process Wrote 92 instructions to a remote process Wrote 9 instructions to a remote process Wrote 34 instructions to a remote process Wrote 58 instructions to a remote process Wrote 18 instructions to a remote process Wrote 45 instructions to a remote process Wrote 24 instructions to a remote process Wrote 12 instructions to a remote process Wrote 50 instructions to a remote process Wrote 189 instructions to a remote process Wrote 15 instructions to a remote process Wrote 116 instructions to a remote process Wrote 10 instructions to a remote process Wrote 56 instructions to a remote process Wrote 26 instructions to a remote process Wrote 49 instructions to a remote process Wrote 61 instructions to a remote process Wrote 6 instructions to a remote process Wrote 17 instructions to a remote process Wrote 647 instructions to a remote process Wrote 31 instructions to a remote process Wrote 48 instructions to a remote process Wrote 162 instructions to a remote process Wrote 750 instructions to a remote process Wrote 53 instructions to a remote process Wrote 63 instructions to a remote process Wrote 120 instructions to a remote process Wrote 163 instructions to a remote process44:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791199284440,"unified_at":"2026-10-05T11:21:24.440Z","metadata":{"hashes":{"sha256":"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","sha1":"2fa6461bb990b3553b17b2139ece685f8e51a837","md5":"5328ba6bd0e05fea64e70db94cca1540","sha512":"d9dfea4042e67fa2b46ed98783a44dd7a515e1fd248a974ba57aef3a845d919f5538c3de8180ca31af58b95e09cb4c157a8407137d4d11151f192dc8e5be2698","ssdeep":"6144:4HagWlD3oYZaIyFdU9C+u7+5rY/3Osa1o7v/:46ge6IyaRa/+to7/","ssdeep_chunks":["6144:4HagWlD","6144:HagWlD3","6144:agWlD3o","6144:gWlD3oY","6144:WlD3oYZ","6144:lD3oYZa","6144:D3oYZaI","6144:3oYZaIy","6144:oYZaIyF","6144:YZaIyFd","6144:ZaIyFdU","6144:aIyFdU9","6144:IyFdU9C","6144:yFdU9C+","6144:FdU9C+u","6144:dU9C+u7","6144:U9C+u7+","6144:9C+u7+5","6144:C+u7+5r","6144:+u7+5rY","6144:u7+5rY/","6144:7+5rY/3","6144:+5rY/3O","6144:5rY/3Os","6144:rY/3Osa","6144:Y/3Osa1","6144:/3Osa1o","6144:3Osa1o7","6144:Osa1o7v","6144:sa1o7v/","12288:4HagWlD","12288:HagWlD3","12288:agWlD3o","12288:gWlD3oY","12288:WlD3oYZ","12288:lD3oYZa","12288:D3oYZaI","12288:3oYZaIy","12288:oYZaIyF","12288:YZaIyFd","12288:ZaIyFdU","12288:aIyFdU9","12288:IyFdU9C","12288:yFdU9C+","12288:FdU9C+u","12288:dU9C+u7","12288:U9C+u7+","12288:9C+u7+5","12288:C+u7+5r","12288:+u7+5rY","12288:u7+5rY/","12288:7+5rY/3","12288:+5rY/3O","12288:5rY/3Os","12288:rY/3Osa","12288:Y/3Osa1","12288:/3Osa1o","12288:3Osa1o7","12288:Osa1o7v","12288:sa1o7v/","6144:46ge6Iy","6144:6ge6Iya","6144:ge6IyaR","6144:e6IyaRa","6144:6IyaRa/","6144:IyaRa/+","6144:yaRa/+t","6144:aRa/+to","6144:Ra/+to7","6144:a/+to7/"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":363520,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1710797408000,"last_seen":1786466362000,"last_multi_scan":1786466362000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","infostealer","evasive"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":166,"suspicious_count":14,"malicious_count":8,"total":188},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.LummaStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Lumma","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.353","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Zusy-10023527-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.353 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AKRF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.LummaStealer.mz!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.ee","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b31e41 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MSIL-TCZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.HTS.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VJR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4688743","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Jalapeno.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found Crypto currency wallets related strings"},{"type":"suspicious","value":"Found Putty/Winscp session related registry strings"},{"type":"malicious","value":"Steals sensitive data from browsers"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTPS web server (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression.filesystem.dll\" (Source: \"00000000-00003404.00000001.100256.00360000.00000004.mdmp\")\n Found string \"clrcompression.dll\" (Source: \"00000000-00003404.00000001.100256.00360000.00000004.mdmp\")\n Found string \"system.io.compression.dll\" (Source: \"00000000-00003404.00000001.100256.00360000.00000004.mdmp\")\n Found string \"system.io.compression.zipfile.dll\" (Source: \"00000000-00003404.00000001.100256.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetDelegateForFunctionPointer\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"FreeHGlobal\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"AllocHGlobal\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 6F680000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"00002068.00000814.5564395.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002068-00000C2C-574662111\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed function \"ToBase64String\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00002068-00000C2C-574659784\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00002068-00000C2C-574659889\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002068-00000C2C-574660000\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00002068-00000C2C-574660239\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002068-00000C2C-574660346\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002068-00000C2C-576314529\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"RegAsm.exe\" called \"CryptStringToBinaryA\" with parameters {\"cchString\": \"0\"\n \"dwFlags\": \"1\"\n \"pcbBinary\": \"00000000\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CreateDecryptor\" in Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-357","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CreateEncryptor\" in Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-358","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.CreateDecryptor\" in Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003404.00000000.100218.00360000.00000004.mdmp, 00000000-00003404.00000001.100256.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /gdroot-g2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com\"\n Contains base64 string in header \"User\" in header \"GET /gdroot-g2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com\"\n Contains base64 string in header \"/gdig2s1\" in header \"GET /gdig2s1-66226.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com\"\n Contains base64 string in header \"Keep\" in header \"GET /gdig2s1-66226.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com\"\n Contains base64 string in header \"User\" in header \"GET /gdig2s1-66226.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.29525","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003404-00000C2C-571808629\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003404-00000C2C-571808629\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003404-00000C2C-570528728\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003404-00000C2C-570531651\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002068-00000C2C-575224624\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002068-00000C2C-575804532\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002068-00000C2C-575912175\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in file \"00002068.00000814.5564395.00401000.wprm\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003404)\n \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003404)\n \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"IsWow64Process\" with parameter \"3404\" - (UID: 00000000-00003404)\n \"RegAsm.exe\" called \"IsWow64Process\" with parameter \"2068\" - (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003404)\n \"RegAsm.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"RegAsm.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"RegAsm.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Select * From Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Select * From Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"5584010,1476,3024,,RtlGetVersion,NTDLL.dll,\"252:11:37.941\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003404.00000001.100256.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" queries volume information of \"C:\\0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" at 00000000-00003404-0000010C-3501528\n \"RegAsm.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002068-0000010C-10261086\n \"RegAsm.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002068-0000010C-10262398","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed API \"GetProcAddress\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"RegAsm.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002068)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00002068)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00002068)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002068)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00002068)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00002068)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"crl.godaddy.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"184.85.65.125:443\"\n \"128.140.125.116:443\"\n \"149.154.167.99:443\"\n \"45.40.131.1:80\"\n \"192.124.249.36:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Rerranged.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$31","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"3859232,1476,3142,,CreateProcessA,kernel32.dll,\"252:11:37.956\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003404.00000001.100256.00360000.00000004.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\monero-project\\monero-core\" in Source: 4653-162-00401C7A\n \"Software\\Martin Prikryl\\WinSCP 2\\Configuration\" in Source: 4653-186-0040B3BB\n \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" in Source: 4653-186-0040B3BB\n \"SOFTWARE\\Microsoft\\Cryptography\" in Source: 4653-247-0040F22E\n \"ISTRY\\USER\\S-1-5-21-2092356043-4041700817-663127204-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00003404.00000001.100256.00360000.00000004.mdmp\n \"SOFTWARE\\monero-project\\monero-core\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\n \"Software\\Martin Prikryl\\WinSCP 2\\Configuration\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\n \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Cryptography\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"FreeConsole\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed unmanaged function \"CreateThread\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed unmanaged function \"WaitForSingleObjectEx\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed unmanaged function \"VirtualProtectEx\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed unmanaged function \"LoadLibrary\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"\n Observed unmanaged function \"GetProcAddress\" in \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0\" (Indicator: \"mozilla/5.0 (\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"ISTRY\\USER\\S-1-5-21-2092356043-4041700817-663127204-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00003404.00000001.100256.00360000.00000004.mdmp\n \"SOFTWARE\\monero-project\\monero-core\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\n \"Software\\Martin Prikryl\\WinSCP 2\\Configuration\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\n \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Cryptography\" in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76380000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 636B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74C50000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74810000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64310000\n \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64AC0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77180000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77180000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e00fe027f6b@ADVAPI32.dll\"\n \"0b000c00cc027f6b@ADVAPI32.dll\"\n \"10001100da027f6b@ADVAPI32.dll\"\n \"150016002073ed69@ADVAPI32.dll\"\n \"0e000f00e473ed69@ADVAPI32.dll\"\n \"0e000f005074ed69@ADVAPI32.dll\"\n \"11001200d47ded69@ADVAPI32.dll\"\n \"110012007c7eed69@ADVAPI32.dll\"\n \"12001300cc7eed69@ADVAPI32.dll\"\n \"12001300387fed69@ADVAPI32.dll\"\n \"14001500e4b7ed69@ADVAPI32.dll\"\n \"1400150000b8ed69@ADVAPI32.dll\"\n \"140015001cb8ed69@ADVAPI32.dll\"\n \"1700180038b8ed69@ADVAPI32.dll\"\n \"0d000e0054b8ed69@ADVAPI32.dll\"\n \"1100120064b8ed69@ADVAPI32.dll\"\n \"110012007cb8ed69@ADVAPI32.dll\"\n \"0f001000ecb9ed69@ADVAPI32.dll\"\n \"1400150038baed69@ADVAPI32.dll\"\n \"1400150054baed69@ADVAPI32.dll\"\n \"0c000d00a8baed69@ADVAPI32.dll\"\n \"0c000d00b8baed69@ADVAPI32.dll\"\n \"0e000f00c8baed69@ADVAPI32.dll\"\n \"0e000f00dcbaed69@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" was detected as \".NET\" and name: \"Library\"\n \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$36","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" [Source: 00000000-00003404-00000C46-12483859232]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RegAsm.exe\" (UID: 00000000-00002068) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"RegAsm.exe\" (UID: 00000000-00002068) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"crl.godaddy.com\"\n \"ocsp.godaddy.com\"\n \"steamcommunity.com\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RegAsm.exe\" (UID: 00000000-00002068)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"RegAsm.exe\" (UID: 00000000-00002068)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$38","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"RegAsm.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"76561199654112719_1_.htm\" has type \"Unknown\"- [targetUID: 00000000-00003404]\n \"9D6B3FE9E6E4067193F477ABAD990106\" has type \"data\"- [targetUID: 00000000-00003404]\n \"67F6625BC22310D5C99DDE12020DBD90\" has type \"data\"- [targetUID: 00000000-00003404]\n \"26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B\" has type \"data\"- [targetUID: 00000000-00003404]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"RegAsm.exe\" queries basic process information of the \"C:\\Windows\\System32\\wbemcomn2.dll\" (UID: 2068)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"RegAsm.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /profiles/76561199654112719\" - (UID: 00000000-00002068), \"RegAsm.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00002068), \"RegAsm.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /r2d0s\" - (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"RegAsm.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"RegAsm.exe\" called \"InternetReadFile\" with parameter 1999 (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"RegAsm.exe\" called \"InternetOpenA\" (UID: 00000000-00002068)\n \"RegAsm.exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:123.0) Gecko/20100101 Firefox/123.0\" (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /gdroot-g2.crl\"\n Found http requests in header \"GET /gdig2s1-66226.crl\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"Found requests in header \"GET /profiles/76561199654112719 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003404.00000000.100218.00CE0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 45.40.131.1 on port 80\n HTTP traffic to 192.124.249.36 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$40","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"xmx.u]r\" [Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b]\n Observed email domain:\"xmx.u]r\" [Source: 00000000-00003404.00000001.100256.00C82000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.3\"\n \"2.5.29.35\"\n \"2.5.29.31\"\n \"128.140.125.116\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"0,.kg\"\n Heuristic match: \"'t.la\"\n Heuristic match: \"crl.godaddy.com\"\n Heuristic match: \"get /gdroot-g2.crl http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crl.godaddy.com\"\n Heuristic match: \"get /gdig2s1-66226.crl http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crl.godaddy.com\"\n Heuristic match: \"ocsp.godaddy.com\"\n Heuristic match: \"steamcommunity.com\"\n Pattern match: \"https://community.akamai.steamstatic.com/\"\n Pattern match: \"https://steamcommunity.com/\"\n Pattern match: \"unity.com/profiles/76561199654112719/badges\"\n Pattern match: \"https://steamcommunity.com/profiles/76561199654112719\"\n Pattern match: \"https://t.me/r2d0s\"\n Pattern match: \"https://community.akamai\"\n Pattern match: \"microsoft.net/framework/v4.0.30319/\"\n Heuristic match: \"12440547182,1476,9,$name,2,0,,system.windows.fo\"\n Heuristic match: \"t4ht(ht.ht\"\n Heuristic match: \"7+.hu\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://steamcommunity.com/profiles/76561199654112719s37hhttps://t.me/r2d0smozilla/5.0\" - Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /profiles/76561199654112719 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /gdroot-g2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com\n\n GET /gdig2s1-66226.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff\n Observed JA3 fingerprint: e6a4e2358d4eee6122403f3cb835bcbd","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"184.85.65.125\" on port \"443\"\n HTTPS traffic to \"128.140.125.116\" on port \"443\"\n HTTPS traffic to \"149.154.167.99\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"file/memory contains long string with (Indicator: \"gcloud\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"Software\\Martin Prikryl\\WinSCP 2\\Configuration\" (Indicator: \"winscp\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Soft: WinSCP\" (Indicator: \"winscp\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Software\\Martin Prikryl\\WinSCP 2\\Configuration\" (Indicator: \"winscp\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found string \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found string \"Soft: WinSCP\" (Indicator: \"winscp\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"5584010,1476,3024,,RtlGetVersion,NTDLL.dll,\"252:11:37.941\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003404.00000001.100256.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegGetValueA\" in \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73070000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"RegAsm.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003404.00000001.100256.00C82000.00000020.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwords.txt\" (Indicator: \"password\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"passwords.txt\" (Indicator: \"password\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Select * From Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"Select * From Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003404.00000000.100218.00360000.00000004.mdmp, 00000000-00003404.00000001.100256.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003404.00000001.100256.01ADA000.00000040.mdmp, 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" opened \"\\Device\\KsecDD\"\n \"RegAsm.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"67F6625BC22310D5C99DDE12020DBD90 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FreeConsole\" (Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b, API is part of module: KERNEL32.DLL)\n Found string \"CreateThread\" (Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b, API is part of module: KERNELBASE.DLL)\n Found string \"WaitForSingleObjectEx\" (Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b, API is part of module: KERNELBASE.DLL)\n Found string \"VirtualProtectEx\" (Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcAddress\" (Source: 0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"RegAsm.exe\" at 00000000-00002068-00000105-2363287","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" launched with commandline \"\" (UID: 00000000-00002068)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b\" has section name .text with entropy \"7.312862523095215\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"RegAsm.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00002068)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * From Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n \"Select * From Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/24 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 184.85.65.125 on port 443 is sent without HTTP header\n TCP traffic to 128.140.125.116 on port 443 is sent without HTTP header\n TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 45.40.131.1 on port 80 is sent without HTTP header\n TCP traffic to 192.124.249.36 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00003404\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found Crypto currency wallets related strings","description":"Observed string: \"\\Monero\\wallet.keys\" (Indicator: \"\\monero\\\") in Source: 4653-162-00401C7A\n Observed string: \"\\Monero\\wallet.keys\" (Indicator: \"\\monero\\\") in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1005","relevance":3,"id":"string-100","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found Putty/Winscp session related registry strings","description":"\"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"software\\martin prikryl\\winscp 2\\sessions\") in Source: 4653-186-0040B3BB\n \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"software\\martin prikryl\\winscp 2\\sessions\") in Source: 00000000-00003404.00000001.100256.02AD0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-94","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"\\AppData\\Roaming\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 4653-183-0040B7C3","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":5,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected system process execution without parameters (likely process injection)","description":"Process \"RegAsm.exe\" with commandline \"\" [UID: 00000000-00002068]","origin":"Monitored Target","mitre_attack_id":"T1218","relevance":7,"id":"target-503","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"RegAsm.exe\" connects to 184.85.65.125:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/24 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"SELECT target_path, tab_url from downloads\"; File: \"00002068.00000814.5564395.00401000.wprm\")\n Found string \"SELECT target_path, tab_url from downloads\"; Source: \"00000000-00003404.00000001.100256.02AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":130,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","infostealer","evasive"],"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a7b50397a02e14fc70df907","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL_Agent.HTS.gen","contacted_countries":["DEU","NLD","USA"],"submit_name":"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","analysis_start_time":"2026-08-11T16:39:22+00:00","indicators_count":{"informative":166,"suspicious":33,"malicious":8},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"184.85.65.125","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"address":"128.140.125.116","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"address":"45.40.131.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"address":"192.124.249.36","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}],"dns_resolutions":[{"domain":"crl.godaddy.com","address":"192.124.249.36","ttl":2714,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"domain":"ocsp.godaddy.com","address":"45.40.131.1","ttl":2179,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"domain":"steamcommunity.com","address":"184.85.65.125","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"domain":"t.me","address":"149.154.167.99","ttl":91,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}],"http_requests":[{"host":"crl.godaddy.com","host_ip":"192.124.249.36:80","url":"/gdroot-g2.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdroot-g2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"host":"crl.godaddy.com","host_ip":"192.124.249.36:80","url":"/gdig2s1-66226.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdig2s1-66226.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}],"processes":[{"pid":3404,"ppid":0,"name":"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe","command_line":"","sha256":"0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b","normalized_path":"C:\\0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b.exe","uid":"00000000-00003404","icon":"$44"},{"pid":2068,"ppid":3404,"name":"RegAsm.exe","command_line":"","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00000000-00003404","uid":"00000000-00002068"}],"all_imported_dlls":["cryptbase.dll","msacm32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wship6.dll","wshqos.dll","kernel32.dll","dhcpcsvc6.dll","msctf.dll","WSHTCPIP.DLL","ws2_32.dll","sfc.dll","wininet.dll","winnsi.dll","nlaapi.dll","KernelBase.dll","ucrtbase.dll","api-ms-win-core-file-l1-2-0.dll","mscoreei.dll","dbghelp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","nlssorting.dll","wbemcomn.dll","msvcp140.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","sspicli.dll","rsaenh.dll","rasadhlp.dll","mscoree.dll","winmm.dll","msasn1.dll","ncrypt.dll","comctl32.dll","Wldap32.dll","sxs.dll","sechost.dll","api-ms-win-crt-utility-l1-1-0.dll","mscorlib.ni.dll","devobj.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mpr.dll","RstrtMgr.dll","clbcatq.dll","vcruntime140.dll","cryptsp.dll","apphelp.dll","cfgmgr32.dll","netprofm.dll","cryptnet.dll","ntdll.dll","lpk.dll","wbemsvc.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","fltLib.dll","gdi32.dll","ole32.dll","api-ms-win-crt-heap-l1-1-0.dll","clr.dll","ucrtbase_clr0400.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","dhcpcsvc.dll","IPHLPAPI.DLL","schannel.dll","bcryptprimitives.dll","wbemprox.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","GdiPlus.dll","advapi32.dll","user32.dll","api-ms-win-crt-time-l1-1-0.dll","psapi.dll","ntdsapi.dll","msvcrt.dll","vcruntime140_clr0400.dll","System.Core.ni.dll","api-ms-win-crt-filesystem-l1-1-0.dll","uxtheme.dll","wintrust.dll","SensApi.dll","clrjit.dll","bcrypt.dll","dnsapi.dll","credssp.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","oleaut32.dll","shlwapi.dll","api-ms-win-crt-math-l1-1-0.dll","tzres.dll","samcli.dll","sfc_os.dll","urlmon.dll","webio.dll","VxSSL32.dll","setupapi.dll","secur32.dll","fastprox.dll","FWPUCLNT.DLL","nsi.dll","AcGenral.dll","wbemdisp.dll","profapi.dll","dwmapi.dll","npmproxy.dll","wbemcomn2.dll","rpcrt4.dll","usp10.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","shell32.dll","RpcRtRemote.dll","imm32.dll","winhttp.dll","version.dll","userenv.dll","iertutil.dll","mswsock.dll","gpapi.dll","System.ni.dll","normaliz.dll","crypt32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"76561199654112719_1_.htm","sha256":"8fd9c228364c0105e1cdec3b93b8d57ca7db962db8d76f4601d23ce81cf7154d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"9D6B3FE9E6E4067193F477ABAD990106","sha256":"3b579eda465e5e0b591f349d92a692820ac79a6f8a01a3fee1a114c9f29d0558","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"67F6625BC22310D5C99DDE12020DBD90","sha256":"81d60881f18bcd97197bec138e6639398634755212d47fac8a09a732d7e054fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B","sha256":"3edf9d5c1c6fd2658f3d790d8ab06fc8ce883217a08746e83abdba23ca5b3849","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a7b50397a02e14fc70df907"}]}]}},"report_ids":{"sandbox_job_ids":["6a7b50397a02e14fc70df907"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Jalapeno.Generic Sample 0de96b70e1e2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0de96b70e1e2…. Malware family: Jalapeno.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b"}],["$","meta","4",{"property":"og:title","content":"Malicious Jalapeno.Generic Sample 0de96b70e1e2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0de96b70e1e2…. Malware family: Jalapeno.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0de96b70e1e27fac1fd2e2a7c61495d06d35be71a5bd08cf1b2ccb338cdfa16b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Jalapeno.Generic Sample 0de96b70e1e2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0de96b70e1e2…. Malware family: Jalapeno.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]