24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cridex Sample 0e0d4494780c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0e0d4494780c…. Malware family: Trojan.Cridex. Threat score 100/100. 19/25 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5","keywords":["Malicious","Trojan.Cridex","malware analysis","sandbox report","threat intelligence","0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5"],"about":{"@type":"SoftwareApplication","name":"bounty-80265044960815111","applicationCategory":["pedll","executable"],"identifier":"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Cridex","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T772,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")26:T72e,Found PE header "MZ" - Source: "00000000-00000192.00000000.178642.00F10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002500.00000000.182505.00ED0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003696.00000000.180561.00F50000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004268.00000000.182484.03220000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004368.00000000.178641.00F40000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004368.00000000.178641.048A8000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004492.00000000.180581.044A0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004492.00000000.180581.04938000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006768.00000000.178642.033F0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006768.00000000.178642.05151000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006820.00000000.178643.00B70000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006820.00000000.178643.04576000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007308.00000000.180571.03400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007308.00000000.180571.05292000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007908.00000000.180582.04710000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007908.00000000.180582.04B39000.00000004.mdmp")27:T429,"rundll32.exe" called "IsWow64Process" with parameter "4368" - (UID: 00000000-00004368) "rundll32.exe" called "IsWow64Process" with parameter "6768" - (UID: 00000000-00006768) "rundll32.exe" called "IsWow64Process" with parameter "8032" - (UID: 00000000-00006768) "rundll32.exe" called "IsWow64Process" with parameter "6820" - (UID: 00000000-00006820) "rundll32.exe" called "IsWow64Process" with parameter "5580" - (UID: 00000000-00006820) "rundll32.exe" called "IsWow64Process" with parameter "192" - (UID: 00000000-00000192) "rundll32.exe" called "IsWow64Process" with parameter "3696" - (UID: 00000000-00003696) "rundll32.exe" called "IsWow64Process" with parameter "7308" - (UID: 00000000-00007308) "rundll32.exe" called "IsWow64Process" with parameter "4492" - (UID: 00000000-00004492) "rundll32.exe" called "IsWow64Process" with parameter "7908" - (UID: 00000000-00007908) "rundll32.exe" called "IsWow64Process" with parameter "4268" - (UID: 00000000-00004268) "rundll32.exe" called "IsWow64Process" with parameter "2500" - (UID: 00000000-00002500)28:T33d6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000048bb5b0038cfd777a434a000b4bb5b00010000005834a000a434a0005834a000040000000400000000e0497700100000b4bb5b00010000005834a000cd97d7779c97d7777fb67e90b50f40775834a0000000d777000000004427ee760000000080ee46770100000000000000f8e24977000000000400000080a96c7448404877f8e24977b8bb5b0080e86876f0d3a00080e86876b4bb5b000000000080e8687600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000aedaa300c4daa300 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005e88a4007688a400 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e9da400429da400 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001e58a4003658a400 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000086baa4009cbaa400 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000aebfa400c6bfa400 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6bea400eebea400 (UID: 00000000-00004368) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000d0bcd30038cfd777a43440033cbdd3000100000058344003a434400358344003040000000400000000e04977001000003cbdd3000100000058344003cd97d7779c97d777cc16b18bb50f4077583440030000d77700000000bc2576760000000080ee46770100000000000000f8e24977000000000400000080a96c7448404877f8e2497740bdd30080e86876d0cf400380e868763cbdd3000000000080e8687600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000046cc43035ccc4303 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000067a44031e7a4403 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d68e4403ea8e4403 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005e49440376494403 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002eac440344ac4403 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000056b144036eb14403 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007eb0440396b04403 (UID: 00000000-00006768) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006820)29:T569,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")2a:T43a,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")2b:T13fe,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004368) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004368) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004368) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006768) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006768) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006768) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006768) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006768) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006820) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006820) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006820) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006820) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006820) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000192) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000192) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000192) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000192) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000192) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003696) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003696) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003696) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003696) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003696) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007308) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007308) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007308) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007308) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007308) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004492) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004492) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004492) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004492) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004492) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007908) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007908) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007908) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007908) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007908) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004268) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004268) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004268) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004268) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004268) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002500) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002500) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002500) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002500) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002500)2c:Tbbba,"rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004368) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00006768) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00006820) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00000192) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00003696) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007308) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004492) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007908) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004268) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00002500) "rundll32.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002500)2d:Te02,Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp")2e:Ta917,Found reference to API (Indicator: "RegRestoreKeyA"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "GetModuleHandleA"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "GetExitCodeProcess"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "GetCommState"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "GetConsoleCP"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "ShowOwnedPopups"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "SetFocus"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "GetUrlCacheEntryInfoExA"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00000192.00000000.178642.00F10000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000192.00000000.178642.00F10000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000192.00000000.178642.00F10000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00000192.00000000.178642.00F10000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00000192.00000000.178642.00F10000.00000040.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00000192.00000000.178642.00F10000.00000040.mdmp, 00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateHeap"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RtlDestroyHeap"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "NtDelayExecution"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp, 00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API (Indicator: "RegRestoreKeyA"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "GetCommState"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "GetUrlCacheEntryInfoExA"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00002500.00000000.182505.00ED0000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002500.00000000.182505.00ED0000.00000040.mdmp, 00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002500.00000000.182505.00ED0000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002500.00000000.182505.00ED0000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002500.00000000.182505.00ED0000.00000040.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00002500.00000000.182505.00ED0000.00000040.mdmp, 00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateHeap"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RtlDestroyHeap"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API (Indicator: "RegRestoreKeyA"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "GetCommState"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "GetUrlCacheEntryInfoExA"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00003696.00000000.180561.00F50000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003696.00000000.180561.00F50000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003696.00000000.180561.00F50000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003696.00000000.180561.00F50000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003696.00000000.180561.00F50000.00000040.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00003696.00000000.180561.00F50000.00000040.mdmp, 00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateHeap"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RtlDestroyHeap"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API (Indicator: "RegRestoreKeyA"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "GetCommState"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "GetUrlCacheEntryInfoExA"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00004268.00000000.182484.03220000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004268.00000000.182484.03220000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004268.00000000.182484.03220000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004268.00000000.182484.03220000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004268.00000000.182484.03220000.00000040.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00004268.00000000.182484.03220000.00000040.mdmp, 00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateHeap"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RtlDestroyHeap"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API (Indicator: "RegRestoreKeyA"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "GetCommState"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "GetUrlCacheEntryInfoExA"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00004368.00000000.178641.00F40000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004368.00000000.178641.00F40000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004368.00000000.178641.00F40000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004368.00000000.178641.00F40000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004368.00000000.178641.00F40000.00000040.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00004368.00000000.178641.00F40000.00000040.mdmp, 00000000-00004368.00000000.178641.04A10000.00000004.mdmp")2f:T816,Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp")30:T4b0,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")31:T5ae,"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "DisplaySYSDMCPL" at ordinal 1 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "EditEnvironmentVariables" at ordinal 2 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "EditUserProfiles" at ordinal 3 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "EnableExecuteProtectionSupportW" at ordinal 4 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "ModifyExecuteProtectionSupportW" at ordinal 5 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "NoExecuteAddFileOptOutList" at ordinal 6 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "NoExecuteAddFileOptOutListW" at ordinal 7 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "NoExecuteProcessExceptionW" at ordinal 8 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "NoExecuteRemoveFileOptOutList" at ordinal 9 "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" contains export function called "NoExecuteRemoveFileOptOutListW" at ordinal 1032:Ta36,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000192.00000000.178642.00A00000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000192.00000000.178642.00A00000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002500.00000000.182505.00BF0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002500.00000000.182505.00BF0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003696.00000000.180561.00650000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003696.00000000.180561.00650000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004268.00000000.182484.03240000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004268.00000000.182484.03240000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004368.00000000.178641.00A00000.00000004.mdmp 00000000-00004368.00000000.178641.04F50000.00000002.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004368.00000000.178641.00A00000.00000004.mdmp 00000000-00004368.00000000.178641.04F50000.00000002.mdmp33:T5b3,Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#1" (UID: 00000000-00004368) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#2" (UID: 00000000-00006768) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#3" (UID: 00000000-00006820) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#4" (UID: 00000000-00000192) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#5" (UID: 00000000-00003696) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#6" (UID: 00000000-00007308) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#7" (UID: 00000000-00004492) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#8" (UID: 00000000-00007908) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#9" (UID: 00000000-00004268) Process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll",#10" (UID: 00000000-00002500)34:T4a0,"rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 772f0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 772f0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 772f0000 "rundll32.exe" loaded module "KERNEL32" at base 77540000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73120000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 77540000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 77120000 "rundll32.exe" loaded module "SSPICLI.DLL" at base 74750000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72d00000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 747c0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74200000 "rundll32.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72a20000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76570000 "rundll32.exe" loaded module "NTDLL.DLL" at base 77d30000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ca0000 "rundll32.exe" loaded module "SHELL32.DLL" at base 7482000035:Td98,"rundll32.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "rundll32.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "rundll32.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "rundll32.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "rundll32.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "rundll32.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "rundll32.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "rundll32.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "rundll32.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "rundll32.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "rundll32.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "rundll32.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "rundll32.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "rundll32.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "rundll32.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "rundll32.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "rundll32.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "rundll32.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "rundll32.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "rundll32.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "rundll32.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "rundll32.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "rundll32.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "rundll32.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "rundll32.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "rundll32.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE")36:T455,"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll" file has an entrypoint instructions - "push esi,pop dword ptr [0x45b750],mov eax, esp,mov dword ptr [0x45b760], eax,jmp 0x401b3a,mov dword ptr [ebp - 4], eax,nop ,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"37:T517,Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00006768), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00006820) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00000192), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00003696) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00007308), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00004492) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00007908), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00004268) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00002500)38:T517,Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00006768), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00006820) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00000192), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00003696) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00007308), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00004492) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00007908), Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00004268) Spawned process "rundll32.exe" with commandline ""C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16 ..." (UID: 00000000-00002500)39:T531,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")3a:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")3b:T579,Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004368.00000000.178641.00A00000.00000004.mdmp")3c:T510,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000192.00000000.178642.04B6D000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002500.00000000.182505.04C75000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003696.00000000.180561.0478B000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004268.00000000.182484.050E4000.00000004.mdmp")3d:T876,Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")3e:T588,Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")3f:T4c8,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")40:Tb1d,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")41:T11b1,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}i" (Indicator: "\Device\"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00000192.00000000.178642.00A00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00002500.00000000.182505.00BF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00003696.00000000.180561.00650000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}bm" (Indicator: "\Device\"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}bm" (Indicator: "\DosDevices\"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00004268.00000000.182484.03240000.00000004.mdmp")42:T12cf,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")43:T56a,Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00000192.00000000.178642.04B40000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00002500.00000000.182505.00F79000.00000002.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00002500.00000000.182505.04BF0000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00003696.00000000.180561.046A0000.00000004.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004268.00000000.182484.050A0000.00000004.mdmp")44:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC45:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC46:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC47:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790929485428,"unified_at":"2026-10-02T08:24:45.428Z","metadata":{"hashes":{"sha256":"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5","sha1":"7175856d3d473772c5e3fbb2af0ee72f9424f59d","md5":"808f8aa2eb9c746712dd4793ba90da70","sha512":"44d6b3891a7c0fec9a2a20d036113d273754433af8a0bb2b630be5a051fd087f0d4a3c2afe2304f27299457e4a946e9dac3bdb213ae13d6b77378982601b2ddb","ssdeep":"6144:Gg12AzW5HsiScvtNybiR8g0ISTFCRVe9/JE+++sKS1JGWWsca65eu9K2zqc4CWAZ:G82AK5HOEksJ1YW7DwzqyQ","ssdeep_chunks":["6144:Gg12AzW","6144:g12AzW5","6144:12AzW5H","6144:2AzW5Hs","6144:AzW5Hsi","6144:zW5HsiS","6144:W5HsiSc","6144:5HsiScv","6144:HsiScvt","6144:siScvtN","6144:iScvtNy","6144:ScvtNyb","6144:cvtNybi","6144:vtNybiR","6144:tNybiR8","6144:NybiR8g","6144:ybiR8g0","6144:biR8g0I","6144:iR8g0IS","6144:R8g0IST","6144:8g0ISTF","6144:g0ISTFC","6144:0ISTFCR","6144:ISTFCRV","6144:STFCRVe","6144:TFCRVe9","6144:FCRVe9/","6144:CRVe9/J","6144:RVe9/JE","6144:Ve9/JE+","6144:e9/JE++","6144:9/JE+++","6144:/JE+++s","6144:JE+++sK","6144:E+++sKS","6144:+++sKS1","6144:++sKS1J","6144:+sKS1JG","6144:sKS1JGW","6144:KS1JGWW","6144:S1JGWWs","6144:1JGWWsc","6144:JGWWsca","6144:GWWsca6","6144:WWsca65","6144:Wsca65e","6144:sca65eu","6144:ca65eu9","6144:a65eu9K","6144:65eu9K2","6144:5eu9K2z","6144:eu9K2zq","6144:u9K2zqc","6144:9K2zqc4","6144:K2zqc4C","6144:2zqc4CW","6144:zqc4CWA","6144:qc4CWAZ","12288:Gg12AzW","12288:g12AzW5","12288:12AzW5H","12288:2AzW5Hs","12288:AzW5Hsi","12288:zW5HsiS","12288:W5HsiSc","12288:5HsiScv","12288:HsiScvt","12288:siScvtN","12288:iScvtNy","12288:ScvtNyb","12288:cvtNybi","12288:vtNybiR","12288:tNybiR8","12288:NybiR8g","12288:ybiR8g0","12288:biR8g0I","12288:iR8g0IS","12288:R8g0IST","12288:8g0ISTF","12288:g0ISTFC","12288:0ISTFCR","12288:ISTFCRV","12288:STFCRVe","12288:TFCRVe9","12288:FCRVe9/","12288:CRVe9/J","12288:RVe9/JE","12288:Ve9/JE+","12288:e9/JE++","12288:9/JE+++","12288:/JE+++s","12288:JE+++sK","12288:E+++sKS","12288:+++sKS1","12288:++sKS1J","12288:+sKS1JG","12288:sKS1JGW","12288:KS1JGWW","12288:S1JGWWs","12288:1JGWWsc","12288:JGWWsca","12288:GWWsca6","12288:WWsca65","12288:Wsca65e","12288:sca65eu","12288:ca65eu9","12288:a65eu9K","12288:65eu9K2","12288:5eu9K2z","12288:eu9K2zq","12288:u9K2zqc","12288:9K2zqc4","12288:K2zqc4C","12288:2zqc4CW","12288:zqc4CWA","12288:qc4CWAZ","6144:G82AK5H","6144:82AK5HO","6144:2AK5HOE","6144:AK5HOEk","6144:K5HOEks","6144:5HOEksJ","6144:HOEksJ1","6144:OEksJ1Y","6144:EksJ1YW","6144:ksJ1YW7","6144:sJ1YW7D","6144:J1YW7Dw","6144:1YW7Dwz","6144:YW7Dwzq","6144:W7Dwzqy","6144:7DwzqyQ"],"imphash":"33296e9aed55b8de95081e21cf80eb98"},"file_info":{"file_name":"bounty-80265044960815111","file_type":["pedll","executable"],"file_type_id":"dll","file_size":655360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1737701139000,"last_seen":1741853111000,"last_multi_scan":1741853111000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","cridex","windows-server-utility"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":46},"sandbox_signatures":{"informative_count":108,"suspicious_count":9,"malicious_count":1,"total":118},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Banker]/Win32.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Dridex.aqc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.EUFW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Cridex-10040735-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.EUFW (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HFNM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.020120A0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0056ca931 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Drixed-FIY!808F8AA2EB9C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cridex.hpjgay","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-ACW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-845578c2!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Ridxed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_35.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Cridex.Win32.928","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Cridex","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Found anti-virus related strings names"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000192.00000000.178642.00F10000.00000040.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002500.00000000.182505.00ED0000.00000040.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00003696.00000000.180561.00F50000.00000040.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004268.00000000.182484.03220000.00000040.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004368.00000000.178641.00F40000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegRestoreKeyA\" (Indicator: \"RegRestoreKey\"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")\n Found reference to API \"RegRestoreKeyA\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00000192.00000000.178642.04B6D000.00000004.mdmp\")\n Found reference to API \"RegRestoreKeyA\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00002500.00000000.182505.04C75000.00000004.mdmp\")\n Found reference to API \"RegRestoreKeyA\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00003696.00000000.180561.0478B000.00000004.mdmp\")\n Found reference to API \"RegRestoreKeyA\" (Indicator: \"RegRestoreKey\"; Source: \"00000000-00004268.00000000.182484.050E4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004268.00000000.182484.73068000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004268.00000000.182484.73068000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$26","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.26460812241067","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000192.00000000.178642.04A10000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00000192.00000000.178642.04A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004368)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006768)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"rundll32.exe\" called \"OpenMutexA\" with parameter \"{0661490a-f7da-8906-158a-ce70180502cc}\" - (UID: 00000000-00004368)\n \"rundll32.exe\" called \"OpenMutexA\" with parameter \"{523f5a6b-34f2-5fc1-136a-7c1e872e33af}\" - (UID: 00000000-00004368)\n \"rundll32.exe\" called \"OpenMutexA\" with parameter \"{9b284786-4e1f-dc6e-6edc-facb770bb660}\" - (UID: 00000000-00004368)\n \"rundll32.exe\" called \"OpenMutexA\" with parameter \"{0661490a-f7da-8906-158a-ce70180502cc}\" - (UID: 00000000-00006768)\n \"rundll32.exe\" called \"OpenMutexA\" with parameter \"{9b284786-4e1f-dc6e-6edc-facb770bb660}\" - (UID: 00000000-00006768)\n \"rundll32.exe\" called \"OpenMutexA\" with parameter \"{0661490a-f7da-8906-158a-ce70180502cc}\" - (UID: 00000000-00006820)\n \"rundll32.exe\" called \"OpenMutexA\" with parameter \"{523f5a6b-34f2-5fc1-136a-7c1e872e33af}\" - (UID: 00000000-00006820)\n \"rundll32.exe\" called \"OpenMutexA\" with parameter \"{9b284786-4e1f-dc6e-6edc-facb770bb660}\" - (UID: 00000000-00006820)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Aside Tabs\" (Indicator: \"set \"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EXPLORER.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"RmnPjJkd.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$31","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$32","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00000192.00000000.178642.00A00000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00002500.00000000.182505.00BF0000.00000004.mdmp\n \"Path=C:\\ProgramData\\Oracle\\Java\\j\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{8BC3F05E-D86B-11D0-A07\" in Source: 00000000-00002500.00000000.182505.00BF0000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00003696.00000000.180561.00650000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00004268.00000000.182484.03240000.00000004.mdmp\n \"Path=C:\\ProgramData\\Oracle\\Java\\j\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{8BC3F05E-D86B-11D0-A07\" in Source: 00000000-00004268.00000000.182484.03240000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00004368.00000000.178641.00A00000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:4368:168:WilStaging_02\"\n \"SM0:4368:64:WilError_01\"\n \"{9b284786-4e1f-dc6e-6edc-facb770bb660}\"\n \"Local\\SM0:4368:64:WilError_01\"\n \"{523f5a6b-34f2-5fc1-136a-7c1e872e33af}\"\n \"Local\\SM0:6768:168:WilStaging_02\"\n \"Local\\SM0:6768:64:WilError_01\"\n \"SM0:6768:64:WilError_01\"\n \"Local\\SM0:6820:64:WilError_01\"\n \"Local\\SM0:6820:168:WilStaging_02\"\n \"SM0:6820:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$33","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 747C0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73610000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77120000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$35","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has an writable section named \".DAta\"\n \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has an writable section named \".crt\"\n \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has an writable section named \".crt0\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$36","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00004368) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00004368) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$37","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00000192.00000000.178642.00F10000.00000040.mdmp\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00002500.00000000.182505.00ED0000.00000040.mdmp\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00003696.00000000.180561.00F50000.00000040.mdmp\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00004268.00000000.182484.03220000.00000040.mdmp\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00004368.00000000.178641.00F40000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 4368)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rundll32.exe\" reads file \"c:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"rundll32.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"rundll32.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"rundll32.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WININET.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WININET.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\EXPLORER.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\explorer.exe\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\EXPLORER.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\explorer.exe\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System\\EXPLORER.EXE\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINDOWS\\System\\explorer.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\0E0D4494780C9010ECE88F39F65BFBFCB13236E1652F7FE41E9C84A5B16583A5.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\0E0D4494780C9010ECE88F39F65BFBFCB13236E1652F7FE41E9C84A5B16583A5.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\0E0D4494780C9010ECE88F39F65BFBFCB13236E1652F7FE41E9C84A5B16583A5.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\0E0D4494780C9010ECE88F39F65BFBFCB13236E1652F7FE41E9C84A5B16583A5.DLL.2.MANIFEST\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"a%.vc\"\n Heuristic match: \"alw.ly\"\n Heuristic match: \"y&a.ua\"\n Heuristic match: \"+,.fk\"\n Heuristic match: \"yqav.bm\"\n Heuristic match: \"jv..bs\"\n Heuristic match: \"`&.nr\"\n Pattern match: \"www.ccleaner.com/ccleaner\"\n Heuristic match: \"?8click here to visit the ccleaner website at ccleaner.com\"\n Heuristic match: \"gmail, outlook.com\"\n Pattern match: \"www.ccleaner.com\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"gt@.gt\"\n Heuristic match: \"8click here to visit the ccleaner website at ccleaner.com\"\n Heuristic match: \"v..bs\"\n Heuristic match: \"js;.jse;.wsf;.ws\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEA9B3D0E30FDB41DD322D18EB9428]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000192.00000000.178642.00A00000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEDCC94840CCECF7EB2881AEF8172D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002500.00000000.182505.00BF0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE5BB8B3131AC0022610F99E2842B8]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003696.00000000.180561.00650000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2103E84017E6A3E877321A541DA5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004268.00000000.182484.03240000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE7C822D19AD73156AC4F8DC64AB10]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004368.00000000.178641.00A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00004368)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00006768)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00006820)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00000192)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00003696)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00007308)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00004492)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00007908)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00004268)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00002500)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00004368)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00006768)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00006820)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00000192)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00003696)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00007308)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00004492)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00007908)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00004268)\n \"rundll32.exe\" called \"GetUserNameW\" (UID: 00000000-00002500)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp, 00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000192.00000000.178642.04B6D000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002500.00000000.182505.04C75000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003696.00000000.180561.0478B000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004268.00000000.182484.050E4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000192.00000000.178642.00F10000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002500.00000000.182505.00ED0000.00000040.mdmp, 00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003696.00000000.180561.00F50000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004268.00000000.182484.03220000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004368.00000000.178641.00F40000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where do you want to install %1\" (Indicator: \"where \"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")\n Found string \"Where do you want to install %1\" (Indicator: \"where \"; Source: \"00000000-00000192.00000000.178642.04B6D000.00000004.mdmp\")\n Found string \"Where do you want to install %1\" (Indicator: \"where \"; Source: \"00000000-00002500.00000000.182505.04C75000.00000004.mdmp\")\n Found string \"Where do you want to install %1\" (Indicator: \"where \"; Source: \"00000000-00003696.00000000.180561.0478B000.00000004.mdmp\")\n Found string \"Where do you want to install %1\" (Indicator: \"where \"; Source: \"00000000-00004268.00000000.182484.050E4000.00000004.mdmp\")\n Found string \"Where do you want to install %1\" (Indicator: \"where \"; Source: \"00000000-00004368.00000000.178641.048A8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"thematupdated3passwords.7417\" (Indicator: \"password\"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")\n Found string \"tupdated3passwords.7417\" (Indicator: \"password\"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")\n Found string \"thematupdated3passwords.7417\" (Indicator: \"password\"; Source: \"00000000-00000192.00000000.178642.04B6D000.00000004.mdmp\")\n Found string \"thematupdated3passwords.7417\" (Indicator: \"password\"; Source: \"00000000-00002500.00000000.182505.04C75000.00000004.mdmp\")\n Found string \"thematupdated3passwords.7417\" (Indicator: \"password\"; Source: \"00000000-00003696.00000000.180561.0478B000.00000004.mdmp\")\n Found string \"thematupdated3passwords.7417\" (Indicator: \"password\"; Source: \"00000000-00004268.00000000.182484.050E4000.00000004.mdmp\")\n Found string \"thematupdated3passwords.7417\" (Indicator: \"password\"; Source: \"00000000-00004368.00000000.178641.048A8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found string \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002500.00000000.182505.04BF0000.00000004.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003696.00000000.180561.046A0000.00000004.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004268.00000000.182484.050A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$41","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002500.00000000.182505.00F79000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"Found string \"Cleaner\" (Indicator: \"cleaner\"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")\n Found string \"Cleaner\t*\" (Indicator: \"cleaner\"; Source: \"00000000-00000192.00000000.178642.04B6D000.00000004.mdmp\")\n Found string \"Cleaner\t*\" (Indicator: \"cleaner\"; Source: \"00000000-00002500.00000000.182505.04C75000.00000004.mdmp\")\n Found string \"Cleaner\t*\" (Indicator: \"cleaner\"; Source: \"00000000-00003696.00000000.180561.0478B000.00000004.mdmp\")\n Found string \"Cleaner\t*\" (Indicator: \"cleaner\"; Source: \"00000000-00004268.00000000.182484.050E4000.00000004.mdmp\")\n Found string \"Cleaner\t*\" (Indicator: \"cleaner\"; Source: \"00000000-00004368.00000000.178641.048A8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00000192.00000000.178642.00A00000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002500.00000000.182505.00BF0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}bm\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00004268.00000000.182484.03240000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00004368.00000000.178641.00A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"rundll32.exe,svchost.exe,ctfmon.exe,smss.exe,csrss.exe\" (Source: \"00000000-00000192.00000000.178642.04A10000.00000004.mdmp, 00000000-00000192.00000000.178642.04B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exeH\" (Indicator: \"explorer.exe\"; File: \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has section name .rdata with entropy \"7.877445390519575\"\n \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has section name .crt with entropy \"7.728910906566153\"\n \"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" has section name .crt0 with entropy \"7.745779372487566\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"rundll32.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"rundll32.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"rundll32.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"rundll32.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"rundll32.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"rundll32.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"rundll32.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004268.00000000.182484.73068000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00000192.00000000.178642.04A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004268.00000000.182484.73068000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"rundll32.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00004368)\n \"rundll32.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00006768)\n \"rundll32.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00006820)\n \"rundll32.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00000192)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\" claimed CRC 1893939118 while the actual is CRC 710399","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetUrlCacheEntryInfoExA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":32,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["banker","cridex","windows-server-utility"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"67d291b61dcc801aef0b504e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll","analysis_start_time":"2025-03-13T08:05:11+00:00","indicators_count":{"informative":108,"suspicious":19,"malicious":1},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}],"processes":[{"pid":776,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00000776"},{"pid":3696,"ppid":776,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00000776","uid":"00000000-00003696"},{"pid":7308,"ppid":776,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#6","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00000776","uid":"00000000-00007308"},{"pid":4492,"ppid":776,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#7","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00000776","uid":"00000000-00004492"},{"pid":7908,"ppid":776,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#8","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00000776","uid":"00000000-00007908"},{"pid":4268,"ppid":776,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#9","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00000776","uid":"00000000-00004268"},{"pid":2500,"ppid":776,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#10","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00000776","uid":"00000000-00002500"},{"pid":4368,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004368","icon":"$44"},{"pid":6768,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006768","icon":"$45"},{"pid":6820,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00006820","icon":"$46"},{"pid":192,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000192","icon":"$47"}],"all_imported_dlls":["aepic.dll","edputil.dll","ntdll.dll","kernel32.dll","apphelp.dll","AcLayers.dll","win32u.dll","advapi32.dll","sfc.dll","VxSSL32.dll","ucrtbase.dll","shell32.dll","rpcrt4.dll","cryptbase.dll","combase.dll","windows.storage.dll","kernel.appcore.dll","powrprof.dll","SHCore.dll","bcryptprimitives.dll","sechost.dll","shlwapi.dll","profapi.dll","sfc_os.dll","fltLib.dll","wininet.dll","wow64win.dll","msvcrt.dll","cfgmgr32.dll","mpr.dll","imagehlp.dll","rsaenh.dll","uxtheme.dll","ntmarta.dll","user32.dll","sspicli.dll","setupapi.dll","IPHLPAPI.DLL","imm32.dll","cryptsp.dll","clbcatq.dll","OneCoreUAPCommonProxyStub.dll","wow64.dll","wow64cpu.dll","KernelBase.dll","bcrypt.dll","ws2_32.dll","cldapi.dll","gdi32.dll","ole32.dll","gdi32full.dll","msvcp_win.dll","oleaut32.dll","0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5.dll","propsys.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:4368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:4368:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"{9b284786-4e1f-dc6e-6edc-facb770bb660}","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:4368:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"{523f5a6b-34f2-5fc1-136a-7c1e872e33af}","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:6768:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:6768:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:6768:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:6820:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:6820:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:6820:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:192:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:192:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:3696:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:3696:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:3696:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:7308:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:7308:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:7308:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:4492:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:4492:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:4492:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:7908:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:7908:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:7908:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:4268:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:4268:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:4268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:2500:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"Local\\SM0:2500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]},{"name":"SM0:2500:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67d291b61dcc801aef0b504e"}]}]}},"report_ids":{"sandbox_job_ids":["67d291b61dcc801aef0b504e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Cridex Sample 0e0d4494780c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0e0d4494780c…. Malware family: Trojan.Cridex. Threat score 100/100. 19/25 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Cridex Sample 0e0d4494780c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0e0d4494780c…. Malware family: Trojan.Cridex. Threat score 100/100. 19/25 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0e0d4494780c9010ece88f39f65bfbfcb13236e1652f7fe41e9c84a5b16583a5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Cridex Sample 0e0d4494780c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0e0d4494780c…. Malware family: Trojan.Cridex. Threat score 100/100. 19/25 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]