26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 9f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T425,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 144f30350453… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 144f30350453…. Threat score 100/100. 0/0 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a"],"about":{"@type":"SoftwareApplication","name":"astx_setup.exe","applicationCategory":["compressed","7zip"],"identifier":"144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":12,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7a8,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp")28:T16d9,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "nsExec.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "DetectTimeDelayThreadProc, WaitForSingleObject Start" (Indicator: "WaitForSingleObject"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "DetectTimeDelayThreadProc, WaitForSingleObject Ends" (Indicator: "WaitForSingleObject"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[ConnectionCloseThreadProc] WaitForMultipleObjectsEx Failed(%d)" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[ConnectionCloseThreadProc] WaitForMultipleObjectsEx Failed(%d)" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[CLogMon::WriteLogThread] WaitForSingleObject failed(%u, ret:%u)" (Indicator: "WaitForSingleObject"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CNetworkStatus::MonitorThreadMain] WaitForMultipleObjects failed(%u, ret:%u)" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::DestroyScanThread] WaitForMultipleObjects Timeout" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CSchedler::Main] SetWaitableTimer failed(%u)" (Indicator: "SetWaitableTimer"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")29:T59b,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "astx_setup.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_GetCompatibilityToken] OpenProcessToken failed(%d)" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CNTProcessParamInfo::EnableTokenPrivilege] OpenProcessToken Failed!" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CEnumUserInfo::EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")2a:T11f8,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "astx_setup.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001180.00000000.202120.72B31000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001180.00000000.202120.72B42000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001180.00000000.202120.72B42000.00000002.mdmp") Found reference to API "PORT_LoadLibraryFromOrigin" (Indicator: "LoadLibrary"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "PR_LoadLibraryWithFlags" (Indicator: "LoadLibrary"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_InitFuncPointer] LoadLibraryFromSystem(ole32.dll) failed(%d)" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] LoadLibraryFromSystem(vssapi.dll) failed(%d)" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[CCoreMain::WriteDisplayVersion] LoadLibrary failed (%lu)" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::Initialize] ARK LoadLibrary (%d)" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::UpdateScanContext] ARK LoadLibrary (%d)" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::GetEDROption] LoadLibrary(%s) failed(%u)" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")2b:T16d7,Found reference to API "[CASDShieldMon::ChangeSvcRecoveryOpt] ChangeServiceConfig2() failed (%u)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API ".\AhnControlService.cpp" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::HasServiceDaclAdminsDeleteRight] OpenSCManager(%u) error" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::HasServiceDaclAdminsDeleteRight] OpenService(%u) error" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::HasServiceDaclAdminsDeleteRight] GetSecurityDescriptorDacl failed(%u)" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::HasServiceDaclAdminsDeleteRight] HeapAlloc failed" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::HasServiceDaclAdminsDeleteRight] QueryServiceObjectSecurity failed (%u)" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::SetServiceDaclAdminsDeleteRight] OpenService(%d) error" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::SetServiceDaclAdminsDeleteRight] Dacl(%d) error" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::AddServiceDaclAdminsDeleteRight] HasServiceDaclAdminsDeleteRight(%s) bAdd:%d bHas:%d" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::TurnOnAM_PPL] ChangeServiceConfig2 bTurnOn(%d) Protected Process failed(%u)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::IsServiceAMPPL] OpenSCManager(%u) error" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::IsServiceAMPPL] OpenService(%u) error" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::IsServiceAMPPL] QueryServiceConfig2 2nd failed (%u)" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::IsServiceAMPPL] QueryServiceConfig2 failed (%u)" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SetServiceDescription : ChangeServiceConfig2 failed(%u)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] QueryServiceStatusEx() failed(%u)" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] OpenService() failed(%u)" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] OpenSCManager() failed(%u)" (Indicator: "ControlService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")2c:Tc83,Found reference to API "OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CASDShieldMon::ChangeSvcRecoveryOpt] : OpenService() failed (%u)" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::StartService] OpenService() failed(%u)" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::StopService] OpenService() failed(%u)" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::QueryServiceStatus] OpenService() failed(%u)" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::HasServiceDaclAdminsDeleteRight] OpenService(%u) error" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::SetServiceDaclAdminsDeleteRight] OpenService(%d) error" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::IsServiceAMPPL] OpenService(%u) error" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::SetServiceAMPPL] OpenService failed(%u)" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SetServiceDescription : OpenService failed(%u)" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] OpenService() failed(%u)" (Indicator: "OpenService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")2d:T13b4,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "aostrust32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "aostrust32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "asc_main.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "asc_main.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "mkd25sdk.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "mkd25sdk.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "tsmime.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "tsmime.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "mkd25sdk64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "mkd25sdk64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "libplc4.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "libplc4.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001180.00000000.202120.72B64000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001180.00000000.202120.72B64000.00000002.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found string "DlABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found string "DlABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found string "FABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")2e:T909,file/memory contains long string with (Indicator: "SHA384"; File: "libacm.dll") file/memory contains long string with (Indicator: "SHA384"; File: "asc_main.dll") file/memory contains long string with (Indicator: "HMAC"; File: "mkd25sdk.dll") file/memory contains long string with (Indicator: "SHA384"; File: "CdmAPI.dll") file/memory contains long string with (Indicator: "SHA384"; File: "tnnipsct.dll") file/memory contains long string with (Indicator: "SHA384"; File: "tnfwct.dll") file/memory contains long string with (Indicator: "SHA384"; File: "tnhipsct.dll") file/memory contains long string with (Indicator: "SHA384"; File: "SysARM64.exe") file/memory contains long string with (Indicator: "SHA384"; File: "V3Hunt.dll") file/memory contains long string with (Indicator: "HMAC"; File: "smime3.dll") file/memory contains long string with (Indicator: "Oid"; File: "smime3.dll") file/memory contains long string with (Indicator: "RC2"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: "SHA512"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: "SHA384"; File: "AhnI2.dll") file/memory contains long string with (Indicator: "SHA384"; File: "SysX64.exe") file/memory contains long string with (Indicator: "HMAC"; File: "mkd25sdk64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "mkd25sdk64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "CdmCtrl.dll") file/memory contains long string with (Indicator: "SHA384"; File: "V3ElamCt.dll") file/memory contains long string with (Indicator: "SHA384"; File: "WinFWMgr.dll") file/memory contains long string with (Indicator: "SHA384"; File: "IAccessible2Proxy.dll") file/memory contains long string with (Indicator: "SHA384"; File: "V3INet2.dll") file/memory contains long string with (Indicator: "SHA384"; File: "AhnCtlKd.dll") file/memory contains long string with (Indicator: "SHA384"; File: "IAccessible2Proxy32.dll") file/memory contains long string with (Indicator: "SHA384"; File: "BtScnCtl.dll") file/memory contains long string with (Indicator: "SHA384"; File: "Mkd2Nadr.sys") file/memory contains long string with (Indicator: "SHA384"; File: "HsbDrv64.sys") file/memory contains long string with (Indicator: "SHA384"; File: "Mkd2bthf.sys")2f:T9c4,"V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000013") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000013") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000014") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000014") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000015") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000015") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000016") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000016") "V3Medic.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS")30:T9cc,"astx_setup.exe" queried SystemProcessInformation at 00000000-00002504-00000C15-2070424442 [PID: 2504] "astx_setup.exe" queried SystemProcessInformation at 00000000-00002504-00000C15-2070431527 [PID: 2504] "astx_setup.exe" queried SystemProcessInformation at 00000000-00002504-00000C15-2070619220 [PID: 2504] "astx_setup.exe" queried SystemProcessInformation at 00000000-00002504-00000C15-2070626861 [PID: 2504] "astx_setup.exe" queried SystemProcessInformation at 00000000-00002504-00000C15-2072104388 [PID: 2504] "astx_setup.exe" queried SystemProcessInformation at 00000000-00002504-00000C15-2072111291 [PID: 2504] "cmd.exe" queried SystemProcessInformation at 00000000-00004292-00000C15-2072852777 [PID: 4292] "cmd.exe" queried SystemProcessInformation at 00000000-00004292-00000C15-2072859943 [PID: 4292] "cmd.exe" queried SystemProcessInformation at 00000000-00004292-00000C15-2073131154 [PID: 4292] "cmd.exe" queried SystemProcessInformation at 00000000-00004292-00000C15-2073149285 [PID: 4292] "cmd.exe" queried SystemProcessInformation at 00000000-00008048-00000C15-2073698394 [PID: 8048] "cmd.exe" queried SystemProcessInformation at 00000000-00008048-00000C15-2073705609 [PID: 8048] "cmd.exe" queried SystemProcessInformation at 00000000-00008048-00000C15-2074036339 [PID: 8048] "cmd.exe" queried SystemProcessInformation at 00000000-00008048-00000C15-2074043315 [PID: 8048] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2093283625 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2093290256 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2093468372 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2093475153 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2094599054 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2094605931 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2095724931 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2095731844 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2095837695 [PID: 5140] "V3Medic.exe" queried SystemProcessInformation at 00000000-00005140-00000C15-2095844563 [PID: 5140] "SysX64.exe" queried SystemProcessInformation at 00000000-00003560-00000C15-2097158427 [PID: 3560]31:T1284,Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001760.00000000.201943.005C0000.00000004.mdmp") Found api reference "[verifyCertDerFile] CertOpenStore failed(errno=%d,%s)" (Indicator: "CertOpenStore"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found api reference "DeleteRootCa, CertDeleteCertificateFromStore failed, GetLastError:%d" (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found api reference "CertAddEncodedCertificateToStore" (Indicator: "CertAddEncodedCertificateToStore"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp")32:T1261,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-9-008CC550 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-9-008CC550 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-23-008D06D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-23-008D06D0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-28-008D0EE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-28-008D0EE0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-38-008CF9F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-38-008CF9F0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-40-008CF770 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-40-008CF770 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-47-008CBB70 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-47-008CBB70 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-48-008CCA00 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-48-008CCA00 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-54-008CFC80 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-54-008CFC80 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-55-008CD240 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-55-008CD240 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-60-008CCAD0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-60-008CCAD0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-62-008CC6C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-62-008CC6C0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-65-008CB470 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-65-008CB470 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-66-008CB740 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-66-008CB740 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-67-008CB980 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-67-008CB980 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-70-008CED40 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-70-008CED40 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-74-008CE4B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-74-008CE4B0 Assembly shows XOR instruction xor al FFh in Stream UID: 00000000-00001180-39117-79-008C9C80 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-80-008CD7D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-80-008CD7D0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-84-008C5370 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-84-008C5370 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-86-008C5540 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-86-008C5540 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-87-008C58A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-87-008C58A0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-93-008C5430 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-93-008C5430 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-101-008C4E60 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-101-008C4E60 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-102-008C1E50 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-102-008C1E50 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001180-39117-103-008C3500 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001180-39117-103-008C350033:Tdf4,Found string "%TEMP%\nst3FC5.tmp\e\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00005140-00000C2E-56204527818") Found string "%PROGRAMFILES%\AhnLab\Safe Transaction\Cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00005140-00000C3D-56216170080") Found string "%TEMP%\nst3FC5.tmp\e\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00005140-00000C2E-56384735384") Found string "%PROGRAMFILES%\AhnLab\Safe Transaction\Cert\nss\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00005140-00000C3D-56397689346") Found string "Extract: softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00005140-00000455-56589705510") Found string "%TEMP%\nst3FC5.tmp\e\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00005140-00000C2E-56616976374") Found string "%PROGRAMFILES%\AhnLab\Safe Transaction\Cert\nss\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00005140-00000C3D-56627395112") Found string "softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001180-00000C66-2151942787") Found string ":\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string ":\program files\ahnlab\safe transaction\cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string ":\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string ":\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string "??\C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string "saction\Cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string "??\C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string ":\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll.2.Config" (Indicator: "softokn3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string "nsaction\cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string "??\c:\program files\ahnlab\safe transaction\cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string ":\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll.2.Config" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string "??\c:\program files\ahnlab\safe transaction\cert\nss\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001180.00000000.202120.01290000.00000004.mdmp") Found string "softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001180.00000000.202120.012C8000.00000004.mdmp") Found string "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001180.00000000.202120.012C8000.00000004.mdmp") Found string "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001180.00000000.202120.012C8000.00000004.mdmp")34:Tb0c,Contains base64 string in header "y3t7dwtZ" in header "GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com" Contains base64 string in header "n0RtzcDjQCJWN4wlpcA=" in header "GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com" Contains base64 string in header "User" in header "GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com" Contains base64 string in header "keep" in header "GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com" Contains base64 string in header "rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=" in header "GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com" Contains base64 string in header "k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=" in header "GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com" Contains base64 string in header "Host" in header "GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com"35:T408,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use RSA keys for encryption and decryption Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - AES encryption36:T481,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "AI7z20.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "RestoreU.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "AhnI2t.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "SysARM64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "AhnUpCtl.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "V3Hunt.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "tsPatcha.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "SysX64.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "nsExec.dll") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp")37:T624,Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00003768-00000C2C-2185864497") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "WTSEnumerateSessionsW" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[ERROR] WTSEnumerateSessionsW(%u)" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CIdleScanHelper::IsUserLogOff] WTSEnumerateSessionsW return FALSE" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CIdleScanHelper] WTSEnumerateSessionsW(%u)" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")38:T599,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "asc_main.dll") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")39:T724,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "astx_setup.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "astx_setup.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "astx_setup.exe") Found reference to API "[_GetDiskFreeSpaceRatioW] GetDiskFreeSpaceExW failed(%d), %s" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_GetDiskFreeSpaceRatioW] GetDiskFreeSpaceExW failed(%d), %s" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_GetDiskFreeSpaceRatioW] %s, Ratio: %d, FreeBytesAvailableToCaller(GBytes):%lf TotalNumberOfBytes(GBytes):%lf TotalNumberOfFreeBytes(GBytes):%lf" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_Recall] _GetDiskFreeSpaceRatio failed(%d), %s" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_PrintSnapShot] _GetDiskFreeSpace failed(%d), %s" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp")3a:T9ee,Found system information discovery API: "ExpandEnvironmentStringsW" in file "astx_setup.exe" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00001760.00000000.201943.0040F000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001760.00000000.201943.0040F000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001760.00000000.201943.0040F000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsForUserW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp" Found system information discovery API: "[CEnumUserInfo::ReplaceEnvironmentString] ExpandEnvironmentStrings(%s), err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp"3b:Td15,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "astx_setup.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "astx_setup.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "postmessage"; File: "CdmAPI.dll") file/memory contains long string with (Indicator: "postmessage"; File: "tnnipsct.dll") file/memory contains long string with (Indicator: "postmessage"; File: "tnfwct.dll") file/memory contains long string with (Indicator: "postmessage"; File: "tnhipsct.dll") file/memory contains long string with (Indicator: "postmessage"; File: "CdmCtrl.dll") file/memory contains long string with (Indicator: "postmessage"; File: "V3ElamCt.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "InstallOptions.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "nsExec.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "mkd3kfnt.sys") file/memory contains long string with (Indicator: "sendmessage"; File: "Cdm2DrNt.sys") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] GetBehaviorTypeString::Unknown Behavior = %u" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] Command = %u" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] DrvComm_RequestUserModeMDPScan call Failed %d" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] DrvComm_RequestUserModeMDPScan( MDP Scan Result == %d" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] DrvComm_RequestKernelFilelessScan called" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] DrvComm_RequestKernelFilelessScan call Failed %d" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] DrvComm_SetKrnlVpDrvAddEncryptedPacket called" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] DrvComm_SetKrnlVpDrvAddEncryptedPacket call Failed %d" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[SessionManager_PostMessageProcessor] Unknown CommID" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp")3c:T4d7,"V3Medic.exe" called "GetWindowTextW" with parameter "Next >" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "Welcome to the AhnLab Safe Transaction Setup Wizard" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "This wizard will guide you through the installation of AhnLab Safe Transaction.It is recommended that you close all other appl" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "< Back" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "A pervious version of this product is installed." - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "2000" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "AhnLab Safe Transaction Reinstallation" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "&Install" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "I Agree" - (UID: 00000000-00005140) "V3Medic.exe" called "GetWindowTextW" with parameter "License Agreement" - (UID: 00000000-00005140)3d:T24ef,"astx_setup.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002504) "astx_setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002504) "astx_setup.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000a4f419006820db76030000000000000098a4e859109a727300000000e4f41900201be076fffffffff4f419005810db763c10db76c8a4e859109a7273d4457273d8457273d4f41900d0f419000d0000000d00000090037473dc547673000000006cac7373d858767368f51900608dde767445162ffeffffff00f51900900fdb769003747310f5190084d47373dc547673900374731cf51900a4d473739003747338f519001a9a727390037473528bda76010000000100000017d4737378f5190086ca7373000000004aca7373fd0fd22a010000000100000000000000000000000000000048f519003dba19f4b8f51900f0cc73733dd6bd59feffffff (UID: 00000000-00002504) "astx_setup.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002504) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000e877880ad402880ad402000000000950e87700002d76030000000651e8770000000060ee7b023429c375000000000000000000000000000000002048c3750800000000000000501331763429c3750000000008000000880ad4020000000000000000000000000000000018000000a5ed79c30000000020e77b0244ee7b02d8ee7b02a0188c73b9f98fb2feffffff94fcec77b0ffd3020000d3020000000000000000139d8a734cee7b0200000000640000000f000d00c853d302000000000d0000000000000080fdd302afffd302b0ffd302b853d3020000d30244ee7b022cee7b02a6ebe877000000000000000000000000b047c375b44f9f9864ee7b02 (UID: 00000000-00004292) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004292) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004292) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000e8771804a9021804a902000000000950e87700002d76030000000651e87700000000f8ed7b023429c375000000000000000000000000000000002048c3750800000000000000501331763429c37500000000080000001804a90200000000000000000000000000000000180000004884a32b00000000b8e67b02dced7b0270ee7b02a0188c73bc90555afeffffff94fcec77c016a9020000a8020000000000000000139d8a73e4ed7b0200000000640000000f0002000054a8020000000002000000000000004816a902bf16a902c016a902f053a8020000a802dced7b02c4ed7b02a6ebe877000000000000000000000000b047c3754b620a6dfced7b02 (UID: 00000000-00008048) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008048) "V3Medic.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005140) "V3Medic.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005140) "V3Medic.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000a4f419006820db76030000000000000025ea67fb109a727300000000e4f41900201be076fffffffff4f419005810db763c10db7675ea67fb109a7273d4457273d8457273d4f41900d0f419000d0000000d00000090037473dc547673000000006cac7373d858767368f51900608dde76c90b998dfeffffff00f51900900fdb769003747310f5190084d47373dc547673900374731cf51900a4d473739003747338f519001a9a727390037473528bda76010000000100000017d4737378f5190086ca7373000000004aca7373531db5bb010000000100000000000000000000000000000048f519003dba19f4b8f51900f0cc737393c4dac8feffffff (UID: 00000000-00005140) "V3Medic.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000005100140000000800140000006c00000000007b23718fd1ff19a50000040030df828848ed1900b0e8eb77313ff5d2feffffff58ed190058746c0000007c7730fa1374d447e877c547e87781ff19a50000000080c314744751b3a04ced1900dcef1900b0ac2874ffffffff8ced190072fa1374dcef19007cce057472fa13740100000000000000020000007cce0574c0ed19000000000080c3147480fa137400000000e8ef19007c0b917710aa9d777351b3a0 (UID: 00000000-00005140) "V3Medic.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001900a0188c73b7f13ac1feffffffc4e91900de668a7358e91900d3e1aeb2ffffffff0000000047678a7301000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff9755b3a09ce91900e8ec1900b0ac2874ffffffffdce9190072fa1374b1cae8777cce057472fa13740100000000000000020000007cce057408ea190044f01900f4e66e0080fa13741cea190040000000d007510000000000c355b3a0 (UID: 00000000-00005140) "V3Medic.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000200000001400170020000000d00751000000510053bfe8770000000020000000b0566c000000000000000000000000000200000020000000c8015100000000000400000000005100120000000000000000006c005750b3a05cec1900f0ec1900b0ac2874ffffffff98ec190072fa1374120000007cce057472fa13740100000000000000020000007cce0574c4ec1900fce96e000000000080fa137410000000fcffffff0000000098ec1900 (UID: 00000000-00005140)3e:T219c,"V3Medic.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000061eb775fd6e77754030000003b6f000000000044fc6d00180000000000000080ea1900400800000000000000000000000000009df819a508e919007cea190000eb1900b0e8eb776123f5d2feffffff6cea190031709077021000000000000000000000001000000000000000000000010000005d580000a4ea19009df819a5 (UID: 00000000-00005140) "V3Medic.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000007510000005100000000000000000000000000d8566c00000000000000000040ec19000200000010000000c0015100000000000200000000005100010000000800000000006c00dc0a510000000000d80a510010f31900febae8770800000000000000080000001708b7b254f51900da91297300006c000800000001000000 (UID: 00000000-00005140) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000002080000000000000e8ee1400000000005088540000000000108c540000000000e049540000000000b0420982fd7f00000000000000000000d0985300000000000000000000000000180000000000000000e0e981fd7f0000001000000000000018000000000000005c5ceb81fd7f000002000000 (UID: 00000000-00003560) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000002080000000000000e8ee140000000000b086540000000000f0825400000000005040540000000000b0420982fd7f00000000000000000000d0985300000000000000000000000000180000000000000000e0e981fd7f0000001000000000000018000000000000005c5ceb81fd7f000002000000 (UID: 00000000-00009068) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009068) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000002080000000000000e8ee140000000000008c62000000000080846200000000008044620000000000b0420982fd7f00000000000000000000d0986100000000000000000000000000180000000000000000e0e981fd7f0000001000000000000018000000000000005c5ceb81fd7f000002000000 (UID: 00000000-00007544) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007544) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000002080000000000000e8ee14000000000070855d0000000000b07c5d0000000000303e5d0000000000b0420982fd7f00000000000000000000a0945c00000000000000000000000000180000000000000000e0e981fd7f0000001000000000000018000000000000005c5ceb81fd7f000002000000 (UID: 00000000-00001760) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001760) "certutil.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000011601000000000d00000000001601600000000000000000002901040816010000290100081601b4fb0f01febae8770000000000000000600000000000000034000000d4fb0f0108f7da76000029010000000060000000ac0000004d56b87260e22b0101000000c0df2b010100000080e12b010100000080482a0150382a01 (UID: 00000000-00001180) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000002080000000000000e8ee140000000000e082580000000000e087580000000000a051580000000000b0420982fd7f00000000000000000000d0985700000000000000000000000000180000000000000000e0e981fd7f0000001000000000000018000000000000005c5ceb81fd7f000002000000 (UID: 00000000-00006588) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006588) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000002080000000000000e8ee14000000000010884d000000000050894d0000000000e03c4d0000000000b0420982fd7f00000000000000000000d0984c00000000000000000000000000180000000000000000e0e981fd7f0000001000000000000018000000000000005c5ceb81fd7f000002000000 (UID: 00000000-00003492) "SysX64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003492) "ASDCli.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000098000000000000000000000000000000a00000000000000000000000000000000a0000000000000000000000000000005992da00000000000000c7020000000083000182fd7f0000000000000000000021d6e1710000000000000000000000000000000000000000000000000000000050c8da000000000000000000 (UID: 00000000-00003768) "ASDCli.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000010000000000000001cf6d0000000000000000000000006400000000000000000000000000000000000000000000000000000000003b80fd7f0000b80e00000000000015b30be2bf760000010000000000000065f208800100000010d0da00000000000a2cc492ff7f00000000000004000000020000000000000000000000 (UID: 00000000-00003768) "ASDCli.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003768) "ASDCli.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000098000000000000000000000000000000a00000000000000000000000000000000a000000000000000000000000000000e9b8da00000000000000c7020000000083000182fd7f0000000000000000000021d6e17100000000000000000000000000000000000000000000000000000000a0c6da000000000000000000 (UID: 00000000-00003768) "ASDCli.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000098000000000000000000000000000000a00000000000000000000000000000000a00000000000000000000000000000079b9ef00000000000000c9020000000083000182fd7f0000000000000000000021d6e1710000000000000000000000000000000000000000000000000000000030c7ef000000000000000000 (UID: 00000000-00005236) "ASDSvc.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000049cdf481fd7f000098000000000000000000000000000000a00000000000000000000000000000000a0000000000000000000000000000000000e7000000000083000182fd7f0000000000000000000021d6e1710000000000000000000000001071490000000000000000000000000060c81b010000000000000000 (UID: 00000000-00002180) "ASDSvc.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000480000000000000098000000000000000000000000000000a00000000000000000000000000000000a0000000000000000000000000000000000e7000000000083000182fd7f0000000000000000000021d6e1710000000000000000000000001071490000000000000000000000000080f21b010000000000000000 (UID: 00000000-00002180) "ASDSvc.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000480000000000000098000000000000000000000000000000a00000000000000000000000000000000a0000000000000000000000000000000000e7000000000083000182fd7f0000000000000000000021d6e1710000000000000000000000001071490000000000000000000000000050751b010000000000000000 (UID: 00000000-00002180) "ASDSvc.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000480000000000000098000000000000000000000000000000a00000000000000000000000000000000a0000000000000000000000000000000000e7000000000083000182fd7f0000000000000000000021d6e17100000000000000000000000010714900000000000000000000000000a05d1b010000000000000000 (UID: 00000000-00002180)3f:T43b,file/memory contains long string with (Indicator: "IsWow64Process"; File: "nsExec.dll") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "IsWow64Process Failed.(%d)" (Indicator: "IsWow64Process"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[UHManager_InjectDllByRemoteThread] IsWow64Process failed(%d), pid=%d" (Indicator: "IsWow64Process"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "IsWow64Process" (Indicator: "IsWow64Process"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp") Found reference to API "IsWow64Process2" (Indicator: "IsWow64Process"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")40:T5e2,Found reference to API "[_PrintSnapShot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_PrintSnapShot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[TT_EnumSnapshot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[TT_EnumSnapshot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[TT_TakeSnapshot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[TT_TakeSnapshot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp")41:T781,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")42:T47b,"astx_setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "astx_setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "V3Medic.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "V3Medic.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "SysX64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SysX64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "certutil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "netsh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")43:Tab2,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")44:T781,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")45:T122a,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "GetVersion"; File: "nsExec.dll") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "NSSSSL_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found reference to API "NSSUTIL_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(GetVersionExW) failed(%d)" (Indicator: "GetVersionExW"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(GetVersionExW) failed(%d)" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_GetCompatibilityToken] GetVersionEx failed(%d)" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[AscVersion::GetAscVersion] pfnAscGetVersion failed(%u)" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "AscGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")46:T43c,Found reference to API "[_PrintSnapShot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[TT_EnumSnapshot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[TT_TakeSnapshot] GetVolumePathNamesForVolumeNameW failed(%d)" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[GetDiskVolumeIdentifier] GetVolumeInformation failed(%u)" (Indicator: "GetVolumeInformation"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")47:T824,Possible dll side loading: %TEMP%\NST3FC5.TMP\AHNIEX.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\NZINST.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MEDEXT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\STCTINST.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\BTSCNCTL.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CERT\NSS\SOFTOKN3.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNCTLKD.DLL %TEMP%\NSUE86E.TMP\NSEXEC.DLL %TEMP%\NST3FC5.TMP\AMBASSMT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNHIPSCT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AMBASSMT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MED\DEFINITION\LIBCRYPTO-1_1-X64.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MED\DEFINITION\LIBSSL-1_1-X64.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TSFLTCTL.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MED\DEFINITION\ATSTRUMT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CORE.DLL %ALLUSERSPROFILE%\AHNLAB\AIS\SAFETRANSACTION\NZINST.DLL %PROGRAMFILES%\AHNLAB\SAFETR~1\AHNCTLKD.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ASDI.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\IPS.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CDMAPI.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CERT\NSS\FREEBL3.DLL %TEMP%\NSUE86E.TMP\SYSTEM.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ATAMPT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\FW.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\PDCFG.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNI2.DLL %TEMP%\NST3FC5.TMP\INSTALLOPTIONS.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AV.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MDP.DLL %TEMP%\NST3FC5.TMP\AI7Z20.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNFWCT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\NZPLUGIN.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\\ASDI.DLL %TEMP%\NST3FC5.TMP\SYSTEM.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNNIPSCT.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNNETUTIL.DLL %TEMP%\NST3FC5.TMP\AHNI2T.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHAWKE.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MEDCORE.DLL %TEMP%\NSUE86E.TMP\AHNIEX.DLL %PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CDMCTRL.DLL48:T703,"V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "V3Medic.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "")49:T4d9,"certutil.exe" queries volume information of "C:\" at 00000000-00001180-00000C17-2151672619 "certutil.exe" queries volume information of "C:\share" at 00000000-00001180-00000C17-2151673506 "certutil.exe" queries volume information of "C:\" at 00000000-00001180-00000C17-2151989525 "certutil.exe" queries volume information of "C:\Program Files\AhnLab\Safe Transaction\Cert\ca2.der" at 00000000-00001180-00000C17-2152115274 "netsh.exe" queries volume information of "C:\" at 00000000-00005148-00000C17-2166112520 "netsh.exe" queries volume information of "C:\" at 00000000-00000772-00000C17-2169913718 "netsh.exe" queries volume information of "C:\" at 00000000-00007924-00000C17-2175399845 "ASDCli.exe" queries volume information of "C:\" at 00000000-00005236-00000C17-2224797772 "ASDSvc.exe" queries volume information of "C:\" at 00000000-00002180-00000C17-2226143963 "ASDSvc.exe" queries volume information of "C:\" at 00000000-00002180-00000C17-2229313268 "ASDSvc.exe" queries volume information of "C:\" at 00000000-00002180-00000C17-2229317429 "ASDSvc.exe" queries volume information of "C:\" at 00000000-00002180-00000C17-2229466958 "ASDSvc.exe" queries volume information of "C:\" at 00000000-00002180-00000C17-22294710104a:T518,Found registry modification API: "RegCreateKeyExW" in file "astx_setup.exe" Found registry modification API: "RegConnectRegistryW" in "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp" Found registry modification API: "[CCommonController::GetRepumonLevelInfo] RegCreateKey (Ret:%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry modification API: "[CEnumUserInfo::SaveProfilePath] RegCreateKeyEx(), err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry modification API: "[CQuarantineItemReg::LoadSubKey] RegCreateKeyEx(%s) failed(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp"4b:T14da,Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CASDShieldMon::ChangeSvcRecoveryOpt] : OpenSCManager() failed (%u)" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::StartService] OpenSCManager() failed(%u)" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::StopService] OpenSCManager() failed(%u)" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::QueryServiceStatus] QueryServiceStatus() failed(%u)" (Indicator: "QueryServiceStatus"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::QueryServiceStatus] OpenService() failed(%u)" (Indicator: "QueryServiceStatus"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::QueryServiceStatus] OpenSCManager() failed(%u)" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::QueryServiceStatus] OpenSCManager() failed(%u)" (Indicator: "QueryServiceStatus"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::HasServiceDaclAdminsDeleteRight] OpenSCManager(%u) error" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::IsServiceAMPPL] OpenSCManager(%u) error" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::SetServiceAMPPL] OpenSCManager failed(%u)" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SetServiceDescription : OpenSCManager failed(%u)" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] QueryServiceStatusEx() failed(%u)" (Indicator: "QueryServiceStatus"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] OpenService() failed(%u)" (Indicator: "QueryServiceStatus"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] OpenSCManager() failed(%u)" (Indicator: "OpenSCManager"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CAhnControlService::QueryServiceStatusEx] OpenSCManager() failed(%u)" (Indicator: "QueryServiceStatus"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")4c:T82a,Found string "MoveFileW" (Indicator: "MoveFileW"; File: "astx_setup.exe") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "MoveFileW"; File: "AI7z20.dll") file/memory contains long string with (Indicator: "MoveFileA"; File: "RestoreU.exe") file/memory contains long string with (Indicator: "MoveFileA"; File: "asc_main.dll") file/memory contains long string with (Indicator: "MoveFileW"; File: "AhnI2t.dll") file/memory contains long string with (Indicator: "MoveFileExA"; File: "V3Hunt.dll") file/memory contains long string with (Indicator: "MoveFileA"; File: "tsPatcha.dll") file/memory contains long string with (Indicator: "MoveFileW"; File: "AhnI2.dll") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found string "MoveFileExA" (Indicator: "MoveFileExA"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found string "[_DeleteFileW] MoveFileExW failed(%d), %s" (Indicator: "MoveFileExW"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")4d:T4c2,"ASDCli.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\2B45CA4F1FAC7F93EC09EABC096123B1E95C0108"; Key: "BLOB") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274"; Key: "BLOB") "ASDCli.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB")4e:T1178,"V3Medic.exe" called "CopyFileA" to copy %ALLUSERSPROFILE%\AhnLab\{0D02314D-EC55-4D53-95FD-41183118B518}\amb.log to new location %ALLUSERSPROFILE%\AhnLab\{0D02314D-EC55-4D53-95FD-41183118B518}\amb-old.log (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy BldInfo.ini to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\BldInfo.ini (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\AhnI2.dll to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\AhnI2.dll (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\mfc90u.dll to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\mfc90u.dll (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\Microsoft.VC90.CRT.manifest to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\Microsoft.VC90.CRT.manifest (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\Microsoft.VC90.MFC.manifest to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\Microsoft.VC90.MFC.manifest (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\msvcm90.dll to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\msvcm90.dll (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\msvcp90.dll to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\msvcp90.dll (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\msvcr90.dll to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\msvcr90.dll (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\NzInst.dll to new location %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\NzInst.dll (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\product.dat.ahc to new location %PROGRAMFILES%\AhnLab\Safe Transaction\AHC\product.dat.ahc (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\msvcp90.dll.ahc to new location %PROGRAMFILES%\AhnLab\Safe Transaction\AHC\X64\msvcp90.dll.ahc (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\msvcr90.dll.ahc to new location %PROGRAMFILES%\AhnLab\Safe Transaction\AHC\X64\msvcr90.dll.ahc (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\msvcp90.dll.ahc to new location %PROGRAMFILES%\AhnLab\Safe Transaction\AHC\X86\msvcp90.dll.ahc (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\msvcr90.dll.ahc to new location %PROGRAMFILES%\AhnLab\Safe Transaction\AHC\X86\msvcr90.dll.ahc (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\aos.sld to new location %PROGRAMFILES%\AhnLab\Safe Transaction\aos.sld (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\defcfg.db to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DB\defcfg.db (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\ipcntry.db to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DB\ipcntry.db (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\nzcmncfg.db to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DB\nzcmncfg.db (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\nzdefcfg.db to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DB\nzdefcfg.db (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\extraopn_ply.ui to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DefPly\extraopn_ply.ui (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\netizen_ply_default.ui to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DefPly\netizen_ply_default.ui (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\ply_ver.ui to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DefPly\ply_ver.ui (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\starter_ply.ui to new location %PROGRAMFILES%\AhnLab\Safe Transaction\DefPly\starter_ply.ui (UID: 00000000-00005140) "V3Medic.exe" called "CopyFileW" to copy %TEMP%\nst3FC5.tmp\e\drvinfo_astx.ini to new location %PROGRAMFILES%\AhnLab\Safe Transaction\drvinfo_astx.ini (UID: 00000000-00005140)4f:T849,"astx_setup.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /C "ECHO Y| cacls %TEMP%\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)"" - (UID: 00000000-00002504) "astx_setup.exe" called "CreateProcessW" with parameter ""%TEMP%\asfEA63.tmp\V3Medic.exe"" - (UID: 00000000-00002504) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" ECHO Y"" - (UID: 00000000-00004292) "cmd.exe" called "CreateProcessW" with parameter "cacls %TEMP%\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)" - (UID: 00000000-00004292) "V3Medic.exe" called "CreateProcessW" with parameter ""%TEMP%\nst3FC5.tmp\SysX64.exe"" - (UID: 00000000-00005140) "SysX64.exe" called "CreateProcessW" with parameter "certutil -addstore -f root "%PROGRAMFILES%\AhnLab\Safe Transaction\Cert\ca2.der"" - (UID: 00000000-00001760) "SysX64.exe" called "CreateProcessW" with parameter "certutil -repairstore root 9c786262fd7479bd "%PROGRAMFILES%\AhnLab\Safe Transaction\Cert\astx.inf"" - (UID: 00000000-00001760) "SysX64.exe" called "CreateProcessW" with parameter ""C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil" -A -n "ASTxRoot2" -d sql:"%APPDATA%\Mozilla\Fi" - (UID: 00000000-00001760), "SysX64.exe" called "CreateProcessW" with parameter ""C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil" -A -n "ASTxRoot2" -d "%APPDATA%\Mozilla\Firefo" - (UID: 00000000-00001760) "SysX64.exe" called "CreateProcessW" with parameter "CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe" - (UID: 00000000-00001760) "SysX64.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall set rule name="AhnLab Safe Transaction" dir=in new action=allow program="%PROGRAMFILES%\AhnLab\Safe T" - (UID: 00000000-00006588), "SysX64.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall delete rule name="AhnLab Safe Transaction" dir=in" - (UID: 00000000-00006588), "SysX64.exe" called "CreateProcessW" with parameter "netsh advfirewall firewall add rule name="AhnLab Safe Transaction" dir=in action=allow program="%PROGRAMFILES%\AhnLab\Safe Trans" - (UID: 00000000-00006588)50:T614e,"astx_setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsuE86E.tmp\AhnIEx.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsuE86E.tmp\System.dll (UID: 00000000-00002504) "astx_setup.exe" called "LoadLibrary" with a parameter %TEMP%\nsuE86E.tmp\nsExec.dll (UID: 00000000-00002504) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004292) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004292) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004292) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004292) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008048) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008048) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008048) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008048) "V3Medic.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %TEMP%\nst3FC5.tmp\AhnIEx.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFolder.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %TEMP%\nst3FC5.tmp\AhnI2t.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %TEMP%\nst3FC5.tmp\ambassmt.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %TEMP%\nst3FC5.tmp\System.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %TEMP%\nst3FC5.tmp\AI7z20.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter %TEMP%\nst3FC5.tmp\InstallOptions.dll (UID: 00000000-00005140) "V3Medic.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005140) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003560) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003560) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003560) "SysX64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003560) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter MFC90ENU.DLL (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\AhnLab\AIS\SafeTransaction\NzInst.dll (UID: 00000000-00009068) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter MFC90ENU.DLL (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInstENU.dll (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInstLOC.dll (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInst.dll (UID: 00000000-00007544) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter MFC90ENU.DLL (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInstENU.dll (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInstLOC.dll (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInst.dll (UID: 00000000-00001760) "SysX64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001760) "certutil.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001180) "certutil.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001180) "certutil.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001180) "certutil.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001180) "certutil.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001180) "certutil.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\Cert\nss\softokn3.dll (UID: 00000000-00001180) "certutil.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\Cert\nss\freebl3.dll (UID: 00000000-00001180) "certutil.exe" called "LoadLibrary" with a parameter %APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release/nssckbi.dll (UID: 00000000-00001180) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter MFC90ENU.DLL (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInstENU.dll (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInstLOC.dll (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006588) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\StCtInst.dll (UID: 00000000-00006588) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005148) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005148) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005148) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005148) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00005148) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005148) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005148) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000772) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000772) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000772) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000772) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00000772) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00000772) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000772) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007924) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007924) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007924) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007924) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00007924) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007924) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007924) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter MFC90ENU.DLL (UID: 00000000-00003492) "SysX64.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\NzInst.dll (UID: 00000000-00003492) "ASDCli.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Version.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\PdCfg.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wintrust.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\Core.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\CdmCtrl.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\CdmAPI.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\AhnCtlKD.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\ATampt.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\SAFETR~1\AhnCtlKD.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\AHawkE.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\av.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\TSFltCtl.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\MeDCore.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\MeDExt.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\ASDi.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\mdp.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\fw.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\TNFwCt.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\ips.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\TNHipsCt.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\TNNipsCt.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter MFC90ENU.DLL (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\nzpluginENU.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\nzpluginLOC.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\nzplugin.dll (UID: 00000000-00003768) "ASDCli.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Version.dll (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\PdCfg.dll (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wintrust.dll (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00005236) "ASDCli.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\ASDi.dll (UID: 00000000-00005236) "ASDSvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Version.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\ASDi.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\PdCfg.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\Core.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Ws2_32.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\MeDCore.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wintrust.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msi.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\MeD\Definition\atstrumt.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\MeD\Definition\libcrypto-1_1-x64.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\MeD\Definition\libssl-1_1-x64.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\MeDExt.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\ambassmt.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\AhnI2.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\BTScnCtl.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\AHawkE.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\\ASDi.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\CdmCtrl.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\CdmAPI.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\AhnCtlKD.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\ATampt.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\SAFETR~1\AhnCtlKD.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\TNNetUtil.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\iphlpapi.dll (UID: 00000000-00002180) "ASDSvc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Wtsapi32.dll (UID: 00000000-00002180) "AKDVE.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006296) "AKDVE.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006296) "AKDVE.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006296) "AKDVE.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006296) "AKDVE.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\AhnLab\Safe Transaction\AHAWKE.dll (UID: 00000000-00006296) "AKDVE.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00006296)51:T2172,"select * from Win32_OperatingSystem" (Source: 00000000-00000772.00000000.203245.AD03C000.00000002.mdmp, Indicator: "select * from win32_operatingsystem") "SELECT DISTINCT a1, a3 FROM nssPublic where id=$ID LIMIT 1;" (Source: 00000000-00001180.00000000.202120.012C8000.00000004.mdmp, Indicator: "select distinct a1, a3 from nsspublic where id=$id limit 1;") "CREATE TABLE IF NOT EXISTS T_LOG_SECURITY ( cSeq INTEGER NOT NULL PRIMARY KEY, cCreated TIMESTAMP, cCategory NUMBER, cName VARCHAR(64), cObject VARCHAR(1024), cStatus NUMBER, cMethod NUMBER, cOwner VARCHAR(64), cExtType NUMBER, cExtSize NUMBER, cExtData BLOB )" (Source: 00000000-00002180.00000000.206903.016AE000.00000004.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "create table if not exists t_log_security ( cseq integer not null primary key, ccreated timestamp, ccategory number, cname varchar(64) cobject varchar(1024) cstatus number cmethod number cowner varchar(64) cexttype number cextsize number cextdata blob )"), "CREATE TABLE IF NOT EXISTS T_LOG_EVENT ( cSeq INTEGER NOT NULL PRIMARY KEY, cCreated TIMESTAMP, cCategory NUMBER, cLevel NUMBER, cFuncId NUMBER, cMsg VARCHAR(1024) cParamStr1 VARCHAR(1024) cParamStr2 VARCHAR(1024) cParamStr3 VARCHAR(1024) cParamStr4 VARCHAR(1024) cExtType NUMBER cExtSize NUMBER cExtData BLOB )" (Source: 00000000-00002180.00000000.206903.016AE000.00000004.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "create table if not exists t_log_event ( cseq integer not null primary key, ccreated timestamp, ccategory number, clevel number, cfuncid number, cmsg varchar(1024) cparamstr1 varchar(1024) cparamstr2 varchar(1024) cparamstr3 varchar(1024) cparamstr4 varchar(1024) cexttype number cextsize number cextdata blob )"), "CREATE TABLE T_SCHEDULE ( cName TEXT NOT NULL UNIQUE PRIMARY KEY, cEnabled INTEGER, cType INTEGER, cYear INTEGER, cMonth INTEGER, cDay INTEGER, cDayOfWeek INTEGER, cHour INTEGER, cMinute INTEGER, cRemoteId INTEGER, cMsgId INTEGER, cMsgData BLOB)" (Source: 00000000-00002180.00000000.206903.016AE000.00000004.mdmp, Indicator: "create table t_schedule ( cname text not null unique primary key, cenabled integer, ctype integer, cyear integer, cmonth integer, cday integer, cdayofweek integer, chour integer, cminute integer, cremoteid integer, cmsgid integer, cmsgdata blob)"), "DELETE FROM `DOMAIN_CERT`" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "delete from `domain_cert`"), "SELECT IP COMMONNAME DOMAIN_KEY DOMAIN_CERT FROM `DOMAIN_CERT`" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "select ip commonname domain_key domain_cert from `domain_cert`"), "SELECT * FROM `DOMAIN_CERT` WHERE IP=?" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "select * from `domain_cert` where ip=?"), "DELETE FROM `DOMAIN_CERT` WHERE IP=?" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "delete from `domain_cert` where ip=?"), "INSERT INTO DOMAIN_CERT (IP, COMMONNAME, DOMAIN_KEY, DOMAIN_CERT) VALUES (?, ?, ?, ?)" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "insert into domain_cert (ip, commonname, domain_key, domain_cert) values (?, ?, ?, ?)"), "DELETE FROM `ROOT_CERT`" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "delete from `root_cert`"), "SELECT IP ROOT_PRIVATE_KEY ROOT_PUBLIC_KEY ROOT_CERT FROM `ROOT_CERT` LIMIT 1" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "select ip root_private_key root_public_key root_cert from `root_cert` limit 1"), "INSERT INTO ROOT_CERT (IP, ROOT_PRIVATE_KEY, ROOT_PUBLIC_KEY, ROOT_CERT) VALUES (?, ?, ?, ?)" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "insert into root_cert (ip, root_private_key, root_public_key, root_cert) values (?, ?, ?, ?)"), "CREATE TABLE `ROOT_CERT` ( IP INT NOT NULL PRIMARY KEY, ROOT_PRIVATE_KEY BLOB NOT NULL, ROOT_PUBLIC_KEY BLOB NOT NULL, ROOT_CERT BLOB NOT NULL );" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "create table `root_cert` ( ip int not null primary key, root_private_key blob not null, root_public_key blob not null, root_cert blob not null );"), "SELECT IP COMMONNAME DOMAIN_KEY DOMAIN_CERT FROM `DOMAIN_CERT` LIMIT 1" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "select ip commonname domain_key domain_cert from `domain_cert` limit 1"), "CREATE TABLE `DOMAIN_CERT` ( IP INT NOT NULL PRIMARY KEY, COMMONNAME TEXT NOT NULL, DOMAIN_KEY BLOB NOT NULL, DOMAIN_CERT BLOB NOT NULL );" (Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp, Indicator: "create table `domain_cert` ( ip int not null primary key, commonname text not null, domain_key blob not null, domain_cert blob not null );"), "select count(*) from sqlite_master where type='table' and name='%s'" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp, Indicator: "select count(*) from sqlite_master where type='table' and name='%s'"), "select * from %s where rowid=0" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp, Indicator: "select * from %s where rowid=0"), "DELETE FROM T_LOG_SECURITY" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "delete from t_log_security"), "DELETE FROM T_LOG_EVENT" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "delete from t_log_event"), "SELECT cSeq cCreated cCategory cLevel cFuncId cMsg cParamStr1 cParamStr2 cParamStr3 cParamStr4 FROM T_LOG_EVENT WHERE (cCreated BETWEEN '%s' AND '%s') AND (%s) ORDER BY cCreated DESC cSeq DESC" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "select cseq ccreated ccategory clevel cfuncid cmsg cparamstr1 cparamstr2 cparamstr3 cparamstr4 from t_log_event where (ccreated between '%s' and '%s') and (%s) order by ccreated desc cseq desc"), "SELECT cSeq cCreated cCategory cLevel cFuncId cMsg cParamStr1 cParamStr2 cParamStr3 cParamStr4 FROM T_LOG_EVENT WHERE (cCreated BETWEEN '%s' AND '%s') AND (%s) ORDER BY cCreated ASC cSeq ASC" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "select cseq ccreated ccategory clevel cfuncid cmsg cparamstr1 cparamstr2 cparamstr3 cparamstr4 from t_log_event where (ccreated between '%s' and '%s') and (%s) order by ccreated asc cseq asc"), "SELECT cSeq cCreated cCategory cLevel cFuncId cMsg cParamStr1 cParamStr2 cParamStr3 cParamStr4 FROM T_LOG_EVENT WHERE cCreated BETWEEN '%s' AND '%s' ORDER BY cCreated DESC cSeq DESC" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "select cseq ccreated ccategory clevel cfuncid cmsg cparamstr1 cparamstr2 cparamstr3 cparamstr4 from t_log_event where ccreated between '%s' and '%s' order by ccreated desc cseq desc"), "SELECT cSeq cCreated cCategory cLevel cFuncId cMsg cParamStr1 cParamStr2 cParamStr3 cParamStr4 FROM T_LOG_EVENT WHERE cCreated BETWEEN '%s' AND '%s' ORDER BY cCreated ASC cSeq ASC" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "select cseq ccreated ccategory clevel cfuncid cmsg cparamstr1 cparamstr2 cparamstr3 cparamstr4 from t_log_event where ccreated between '%s' and '%s' order by ccreated asc cseq asc"), "SELECT * FROM T_LOG_EVENT" (Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, Indicator: "select * from t_log_event")52:T1417,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "CreateProcess"; File: "nsExec.dll") Found reference to API "[ASDCommon::CreateProcessAsPP] Err(%d) retry basic <%s %s>" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[ASDCommon::CreateProcessAsPPFromIPSE] Err(%d) retry basic <%s %s>" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[ASDCommon::CreateProcessAsPPFromIPSE] Waiting failed(%u)" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[CUtilAMPPL::CPAPP] CreateProcessW error (%d)" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[CreateProcessTimeout] STILL_ACTIVE(TerminateProcess)" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[CreateProcessTimeout] break TIMEOUT" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[CreateProcessTimeout] CreateProcess failed(errno=%d)" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "29993371798,1172,3143,,CreateProcessW,kernel32.dll,"00:52:43.156",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00001760.00000001.202455.005C0000.00000004.mdmp") Found reference to API "CreateProcessScanAll" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[GetGlobalSettingOption] CreateProcessScanAll=%u" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[MeDGetGlobalOptionData] CreateProcessScanAll On/Off=%d" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CWSCCtrl::RunASDWsc] ASDCommon::CreateProcessAsPPFromInstallPath failed(%u)" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[ASDSvcHelper::Tray::ExecuteAppInSession] SessionHelper.CreateProcessInSession(sid:%d) success" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[ASDSvcHelper::Tray::ExecuteAppInSession] SessionHelper.CreateProcessInSession(sid:%d) failed(%u)" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[ASDSvcHelper::Svc::ExecuteAppInAllSession] SessionHelper.CreateProcessInSession(sid:%d) success" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[ASDSvcHelper::Svc::ExecuteAppInAllSession] SessionHelper.CreateProcessInSession(sid:%d) failed(%u)" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "..\CommonClass\CreateProcessInSession.cpp" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScanDRMManager::Load] CreateProcess(%s) failed(%u)" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[ASDCommon::CreateProcessAsPP] Err(%d) retry basic <%s %s>" (Indicator: "CreateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")53:T91d,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "astx_setup.exe") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_CreateDirectoryW] CreateDirectoryW failed(%d), %s" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendCopyFile] _CreateDirectory failed(%d), %s" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SHCreateDirectoryExW" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CCoreMain::OnMakeTempDir] SHCreateDirectoryEx(%s), failed(%d)" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[ISecuredDBImpl::Backup] CreateDirectory(%s)(%u)" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CMailFileScanner::CleanFile] CreateDirectory (%u) [path:%s]" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CMailFileScanner::CreateTempDir] CreateDirectory (Ret:%u) [path:%s]" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[MakeFolder::MakeBTLogFolder] SHCreateDirectoryEx(%s), failed(%d)" (Indicator: "CreateDirectory"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")54:T986,Found reference to API "[DrvComm_SetNetworkIsolatedEnviornment] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_SET_NETWORKISOLATEDENV] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_FinalizeMeDCoreD] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_STOP] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[InitializeMeDCoreD] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_START] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_SetKrnlHashControl] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_SET_HASH_CONTROL] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_SetGlobalOption] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_SET_GLOBAL_OPTION] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_SetArtVeRoot] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_SET_ART_VEROOT] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_SetArtVeRoot] Dispatcher_DeviceIoControl[IOCTL_MEDVPDRV_SET_ART_VEROOT] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_SetMDPVirusnameWithSeq] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_SET_MDP_VIRUSNAME_WITH_SEQ] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_SetWhiteProcExecReportPolicy] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_SET_WHITEPROC_EXEC_REPORT_POLICY] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[DrvComm_SetUseMLCloudReputation] Dispatcher_DeviceIoControl[MEDCORED_CONTROL_SET_USE_ML_CLOUDREPUTATION] Failed (%d)" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp")55:T1043,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "CreateFile"; File: "nsExec.dll") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SearchDriveToMonitoring, CreateFileW failed (%s) Drive (%d)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SearchDriveToMonitoring, CreateFileW succeded (%s) Drive" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_SetFileTime] CreateFileW failed(%d), %s" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "[CASDShieldMon::CreateUFPRuleFile] CreateFile failed(%lu)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CGetADS::IsADSExist] CreateFile(%s) Failed(%d)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::ScanProtectedFile] CreateFile (Loop:%d) (ErrCode:%d)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::EraseFile] AhnCreateFile (Ret:%d) [filepath:%s]" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CMemoryDMZ::GetFileData] CreateFile (Ret:%u) [path:%s]" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CLogImpl::GetMD5] CreateFile (Ret:%u) [Path:%s]" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "[CLogImpl::GetSHA256] CreateFile (Ret:%u) [Path:%s]" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "[CImport::Isolate] CreateFile failed(%s)(%u)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "[CImportFileItem::Isolate] CreateFile failed(%u)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "[CImportFileItem::Crc64] CreateFile failed(%u)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "[CQuarantineFile::Isolate] CreateFile failed(%u)" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "AntiStealthCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp")56:T86a,Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")57:T80d,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "astx_setup.exe") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "astx_setup.exe") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_DeleteFileW] MoveFileExW failed(%d), %s" (Indicator: "MoveFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[ISecuredDBImpl::Encrypt] MoveFile(%s, %s)(%u)" (Indicator: "MoveFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[ISecuredDBImpl::Decrypt] MoveFile(%s, %s)(%u)" (Indicator: "MoveFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[ISecuredDBImpl::Restore] MoveFile(%s, %s)(%u)" (Indicator: "MoveFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")58:T8a8,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "astx_setup.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "OpenThread [pid: %d, tid: %d] Failure %d" (Indicator: "OpenThread"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "Wow64GetThreadContext was not initialized. ERROR!" (Indicator: "GetThreadContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "Wow64GetThreadContext Failure.(%d)" (Indicator: "GetThreadContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "Wow64GetThreadContext SUCCESS." (Indicator: "GetThreadContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "UMStackWalk_HasSuspiciousStack, GetThreadContext Error.(%d)" (Indicator: "GetThreadContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp")59:Tf67,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "astx_setup.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "OpenProcess [pid: %d] Failure %d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[UHManager_InjectDllByRemoteThread] OpenProcess failed(%d), pid=%d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[UHManager_EjectDllByRemoteThread] faild(pid:%d), OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "DetectTimeDelayThreadProc, OpenProcess Failed. LastError = (%d), pid = (%d), dwDesiredAccess = (0x%x)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_GetCompatibilityToken] OpenProcessToken failed(%d)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CNTProcessParamInfo::EnableTokenPrivilege] OpenProcessToken Failed!" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CNTProcessParamInfo::GetNtProcessDetailInfo] OpenProcess Failed (PID:%u), (Ret:%u)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[ERROR] [AhnFindModule] OpenProcess [PID:%d] dwErr=%d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[INFO] [AhnFindModule] OpenProcess [PID:%d] dwErr=%d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[AhnFindModuleByFileName] OpenProcess [PID:%u] dwErr=%u" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CEnumUserInfo::EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")5a:Te9f,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "GetLastError"; File: "System.dll") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001180.00000000.202120.72B42000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "DeleteRootCa, CertDeleteCertificateFromStore failed, GetLastError:%d" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WorkerThreadProc] setsockopt SO_UPDATE_ACCEPT_CONTEXT fail, WSAGetLastError=%d" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WebServerStart] setsockopt SO_CONDITIONAL_ACCEPT fail, WSAGetLastError=%d" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SSLAcceptLocal, BioIntCtrl Fail, ret = %d, GetLastError=%u" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SSLAcceptLocal, SslAccept Fail, sslErr=%d, GetLastError=%d" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SSLConnectWeb, BioIntCtrl Fail, ret = %d, GetLastError=%u" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SSLConnectWeb, ParseHttps Fail, GetLastError=%u" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebWrite, send fail, WSAGetLastError=%d(%p)" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebRead, recv fail, WSAGetLastError=%d(%p)" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "LocalWrite, send fail, WSAGetLastError=%d(%p)" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CIdleScanHelper::IsRunningMonitorOffEvent] GetLastError(%u)" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")5b:T42c,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "astx_setup.exe") Found reference to API "[IsDesktopExplorer] GetWindowThreadProcessId Failed(%u)" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetShellWindow" (Indicator: "GetShellWindow"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[IsDesktopExplorer] GetWindowThreadProcessId Failed(%u)" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")5c:Tebc,Found reference to API "[CASDShieldMon::StartService] StartUserFolderProtect is failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CASDShieldMon::StartService] License is expired" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CASDShieldMon::StartService] UpdateUserFolderProtect is failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CCoreMain::Initialize] m_pLogMon->StartService failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CCoreMain::Restore] m_pLogMon->StartService failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CCoreMain::OnStart] m_pReportServer->StartService failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CCoreMain::OnStart] m_pSelfProtect->StartService failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] Failed to create running event(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] Failed to start http server(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] ASDCommon::GetInstallPath failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] Already running" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] ServerPort (old:%u) (new:%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] (ServerPort:%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] cOption.ReadOptions() failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService] cOption.Initialize() failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CReportServer::StartService]" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::StartService] OpenSCManager() failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::StartService] OpenService() failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CProductCtrlHelper::StartService] StartService() failed(%u)" (Indicator: "StartService"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")5d:T19bb,"Software\Microsoft\Windows\CurrentVersion" in Source: astx_setup.exe "HKLM\SYSTEM" in Source: 00000000-00002180-00000BC0-2233802343 "HKLM\SOFTWARE" in Source: 00000000-00002180-00000BC0-2233804594 "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00000772.00000000.203245.AD03C000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00000772.00000000.203245.AD03C000.00000002.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00001760.00000000.201943.005C0000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00001760.00000000.201943.02D30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\Safe Transaction\StCtInst" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\Ahnlab\Safe Transaction" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\ASDF\SafeTransaction" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "fSOFTWARE\AhnLab\Safe Transaction\Option" in Source: 00000000-00002180.00000000.206903.00470000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\AhnLab\ASD" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "HKLM\%s\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\services\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "HKLM\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "HKLM\system\currentcontrolset\control\ServiceGroupOrder" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\APC2\Policy Admin" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\APC2\Policy Server" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\APC2\Policy Agent" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\AHNLAB" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Classes\CLSID" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Microsoft\AMSI\Providers" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\MicroSoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\AhnLab\I18N" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Ahnlab\ScanDRM" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\FileSystem" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Ahnlab\TrusZone" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp 00000000-00002180.00000000.206903.59099000.00000002.mdmp 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp5e:T927,Process astx_setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2504:168:WilStaging_02" Process astx_setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2504:64:WilError_03" Process astx_setup.exe created mutex with name "\BaseNamedObjects\_Mutex_AIL_Log_" Process astx_setup.exe created mutex with name "SM0:2504:64:WilError_03" Process astx_setup.exe created mutex with name "Local\SM0:2504:168:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4292:168:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:4292:168:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8048:168:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:8048:168:WilStaging_02" Process V3Medic.exe created mutex with name "\BaseNamedObjects\AMB_MasslogFilePath" Process V3Medic.exe created mutex with name "\BaseNamedObjects\AMB_CreateCid" Process V3Medic.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5140:168:WilStaging_02" Process V3Medic.exe created mutex with name "Local\SM0:5140:168:WilStaging_02" Process V3Medic.exe created mutex with name "Global\_Mutex_AIL_Log_" Process V3Medic.exe created mutex with name "Local\SM0:5140:64:WilError_03" Process V3Medic.exe created mutex with name "SM0:5140:64:WilError_03" Process V3Medic.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5140:64:WilError_03" Process V3Medic.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5140:64:WilError_03" Process V3Medic.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\_Mutex_AIL_Log_" Process V3Medic.exe created mutex with name "\BaseNamedObjects\_mutex_ai2_log_" Process V3Medic.exe created mutex with name "\BaseNamedObjects\AMB_MultiThreadMutex" Process V3Medic.exe created mutex with name "\BaseNamedObjects\C:_ProgramData_AhnLab_{0D02314D-EC55-4D53-95FD-41183118B518}_amb.log" Process V3Medic.exe created mutex with name "\BaseNamedObjects\_Mutex_AIL_SingleInstance_{FF56B785-EF71-461B-AF11-9891E8303723}_ASTX" Process SysX64.exe created mutex with name "\BaseNamedObjects\_mutex_ahni2_log_" Process SysX64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9068:304:WilStaging_02"5f:T89f,"ASDUp.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ASDCli.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "AupASD.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "StSdk.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ASDSvc.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ASDCr.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "NzBrcom.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Mdp.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "SCTX.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "StSvr.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "NzPlugin.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "StCtl.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "StCli.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ambassmt.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "TNNetUtil.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "StSdk32.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Atampt.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "NzBrcom32.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT60:T7bb8,"SOFTWARE\Microsoft\NetSh" in Source: 00000000-00000772.00000000.203245.AD03C000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00000772.00000000.203245.AD03C000.00000002.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00001760.00000000.201943.005C0000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00001760.00000000.201943.02D30000.00000004.mdmp "Software\AhnLab\ACA" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\Safe Transaction\StCtInst" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "Software\Ahnlab\Safe Transaction" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\ASDF\SafeTransaction" in Source: 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp " fSOFTWARE\AhnLab\Safe Transaction\Option" in Source: 00000000-00002180.00000000.206903.00470000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp "Software\AhnLab\ASD" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00002180.00000000.206903.10202000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "HKLM\%s\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "HKLM\SYSTEM\CurrentControlSet\services\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "HKLM\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "HKLM\system\currentcontrolset\control\ServiceGroupOrder" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\APC2\Policy Admin" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\APC2\Policy Server" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\APC2\Policy Agent" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\AHNLAB" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Classes\CLSID" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Microsoft\AMSI\Providers" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\MicroSoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\I18N" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Ahnlab\ScanDRM" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\FileSystem" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\Ahnlab\TrusZone" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\userchoice" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\Classes\%s\Application" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\AHNLAB" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\AhnLab\I18N" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\Ahnlab\ASPack\9.0" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SYSTEM\CurrentControlSet\services" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\MicroSoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00002180.00000000.206903.59099000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "Software\Ahnlab\Safe Transaction" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\ASDF\SafeTransaction" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s\Parameters\ButtonStatus" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\AhnLab\I18N" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp "y\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003492.00000000.203907.004C0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00003492.00000000.203907.004C0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003492.00000000.203907.004C0000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00003492.00000000.203907.02B30000.00000004.mdmp "Software\AhnLab\ACA" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Enum\%s\Device Parameters" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Enum\%s" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s\Enum" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\AhnLab" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\AHNLAB" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\Ahnlab\Safe Transaction" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.EXE" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Google\Update\Clients" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\AhnLab" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\Classes\VirtualStore\MACHINE\SOFTWARE\AhnLab" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "SOFTWARE\AhnLab\ASDF\SafeTransaction" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "[NzInst_Unregister] RecurseDeleteKey(HKEY_CLASSES_ROOT\astx) error(%d)" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "Software\Ahnlab\Safe Transaction\Option\Update" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx) error(%d)" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx\URL Protocol) error(%d)" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx\shell) error(%d)" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx\shell\open\command) error(%d)" in Source: 00000000-00003492.00000000.203907.59C74000.00000002.mdmp "y\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003492.00000001.204128.004C0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00003492.00000001.204128.004C0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003492.00000001.204128.004C0000.00000004.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003768.00000000.204044.02CF5000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00003768.00000000.204044.02CF5000.00000002.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00003768.00000000.204044.02CF5000.00000002.mdmp "System\CurrentControlSet\Services\TNNipsNt_SafeTransaction" in Source: 00000000-00003768.00000000.204044.03140000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00003768.00000000.204044.03167000.00000004.mdmp "System\CurrentControlSet\Services\AMonCDW8" in Source: 00000000-00003768.00000000.204044.03167000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00003768.00000000.204044.03198000.00000004.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003768.00000000.204044.5390B000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00003768.00000000.204044.5390B000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "SOFTWARE\MicroSoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "System\CurrentControlSet\Services\TCPIP6" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "System\CurrentControlSet\Control\GroupOrderList" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "System\CurrentControlSet\Services\AMonTDnt" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00003768.00000000.204044.5962E000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\AMonTDLH" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\AMonLWLH" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "System\CurrentControlSet\Services" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "System\CurrentControlSet\Services\Vxd" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "System\CurrentControlSet\Control\GroupOrderList" in Source: 00000000-00003768.00000000.204044.779B5000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00003768.00000001.204122.01120000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003768.00000001.204122.01120000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00003768.00000001.204122.03174000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005140.00000000.198399.006C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005140.00000000.198399.736ED000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00005140.00000000.198399.736ED000.00000002.mdmp "Software\AhnLab\AhnInst\%d" in Source: 00000000-00005140.00000000.198399.736ED000.00000002.mdmp "Software\Microsoft\Windows" in Source: 00000000-00005140.00000001.200319.006C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005140.00000002.202240.00408000.00000002.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005140.00000002.202240.006C0000.00000004.mdmp "Software\AhnLab\ASDF\SafeTransaction" in Source: 00000000-00005140.00000002.202240.006C0000.00000004.mdmp "Software\Microsoft\Windows" in Source: 00000000-00005140.00000002.202240.006C0000.00000004.mdmp "Software\Ahnlab\APC2\Policy Agent" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "Software\AhnLab\" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDlls" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00005140.00000002.202240.101F0000.00000002.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005148.00000000.202919.45CCC000.00000004.mdmp "SOFTWARE\AhnLab\Safe Transaction\Option" in Source: 00000000-00005236.00000000.206770.00FC0000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00005236.00000000.206770.03107000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005236.00000001.206803.00FC0000.00000004.mdmp "SOFTWARE\AhnLab\Safe Transaction\Option" in Source: 00000000-00005236.00000001.206803.00FC0000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00005236.00000001.206803.03105000.00000004.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "MACHINE\Software\AhnLab" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "MACHINE\Software\Microsoft" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SOFTWARE\AhnLab" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "System\CurrentControlSet\Services\%s" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\Classes\CLSID" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\Microsoft\AMSI\Providers" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\AhnLab\I18N" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SYSTEM\CurrentControlSet\services" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\FileSystem" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SOFTWARE\MicroSoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "SYSTEM\ControlSet001\Control\Lsa" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00005236.00000001.206803.67B46000.00000002.mdmp "\REGISTRY\SYSTEM\CONTROLSET001\SERVICES" in Source: 00000000-00006296.00000000.207447.0041D000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00006588.00000000.202780.00570000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.37!7" in Source: 00000000-00006588.00000000.202780.00570000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00006588.00000000.202780.00570000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.2!7" in Source: 00000000-00006588.00000000.202780.00570000.00000004.mdmp "-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006588.00000000.202780.005BD000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00006588.00000000.202780.02810000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00006588.00000001.203582.00570000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.37!7" in Source: 00000000-00006588.00000001.203582.00570000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00006588.00000001.203582.00570000.00000004.mdmp "-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006588.00000001.203582.005BD000.00000004.mdmp "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007924.00000000.203572.E75C2000.00000004.mdmp "ProductKeyPath=SOFTWARE\AhnLab\Safe Transaction" in Source: 00000000-00008168.00000000.206624.02C20000.00000004.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\userchoice" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SOFTWARE\Classes\%s\Application" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SOFTWARE\AHNLAB" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\AhnLab\I18N" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\Ahnlab\ASPack\9.0" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SYSTEM\CurrentControlSet\services" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SOFTWARE\MicroSoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00008168.00000000.206624.59099000.00000002.mdmp "Software\AhnLab\ACA" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Enum\%s\Device Parameters" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Enum\%s" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\%s\Enum" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\AhnLab\EPP Agent\1.0" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\AhnLab\ASDF" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\AhnLab\AhnInst" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\AhnLab" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\AHNLAB" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\Ahnlab\Safe Transaction" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s.EXE" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Google\Update\Clients" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\AhnLab" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\Classes\VirtualStore\MACHINE\SOFTWARE\AhnLab" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "SOFTWARE\AhnLab\ASDF\SafeTransaction" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "[NzInst_Unregister] RecurseDeleteKey(HKEY_CLASSES_ROOT\astx) error(%d)" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "Software\Ahnlab\Safe Transaction\Option\Update" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx) error(%d)" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx\URL Protocol) error(%d)" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx\shell) error(%d)" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp "[NzInst_StartService] RegSetValueStr(HKEY_CLASSES_ROOT\astx\shell\open\command) error(%d)" in Source: 00000000-00008168.00000000.206624.59C74000.00000002.mdmp61:T559b,"astx_setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 777c0000 "astx_setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 777c0000 "astx_setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 777c0000 "astx_setup.exe" loaded module "KERNEL32" at base 76ea0000 "astx_setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737c0000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75340000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 753c0000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 77030000 "astx_setup.exe" loaded module "NTDLL.DLL" at base 77e40000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 748f0000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73790000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73780000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73720000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76770000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 75240000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75b30000 "astx_setup.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73710000 "astx_setup.exe" loaded module "KERNEL32.DLL" at base 76ea0000 "astx_setup.exe" loaded module "%TEMP%\NSUE86E.TMP\AHNIEX.DLL" at base 10000000 "astx_setup.exe" loaded module "WINTRUST.DLL" at base 76660000 "astx_setup.exe" loaded module "RPCRT4.DLL" at base 77680000 "astx_setup.exe" loaded module "%TEMP%\NSUE86E.TMP\SYSTEM.DLL" at base 73700000 "astx_setup.exe" loaded module "%TEMP%\NSUE86E.TMP\NSEXEC.DLL" at base 736f0000 "astx_setup.exe" loaded module "KERNELBASE" at base 777c0000 "cmd.exe" loaded module "KERNEL32" at base 76ea0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 777c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 777c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 777c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76740000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 777c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 777c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 777c0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737c0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76ea0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77e40000 "cmd.exe" loaded module "KERNELBASE" at base 777c0000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75320000 "V3Medic.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 777c0000 "V3Medic.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 777c0000 "V3Medic.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 777c0000 "V3Medic.exe" loaded module "KERNEL32" at base 76ea0000 "V3Medic.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737c0000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75340000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 753c0000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 77030000 "V3Medic.exe" loaded module "NTDLL.DLL" at base 77e40000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75270000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 748f0000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73790000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73780000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73720000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76770000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 75240000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75b30000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73710000 "V3Medic.exe" loaded module "KERNEL32.DLL" at base 76ea0000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\AHNIEX.DLL" at base 10000000 "V3Medic.exe" loaded module "WINTRUST.DLL" at base 76660000 "V3Medic.exe" loaded module "RPCRT4.DLL" at base 77680000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\AHNI2T.DLL" at base 736d0000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\AMBASSMT.DLL" at base 732f0000 "V3Medic.exe" loaded module "SECUR32.DLL" at base 732e0000 "V3Medic.exe" loaded module "IPHLPAPI.DLL" at base 753e0000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 732b0000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75c60000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\SYSTEM.DLL" at base 732a0000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\AI7Z20.DLL" at base 2820000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 73230000 "V3Medic.exe" loaded module "COMCTL32.DLL" at base 758c0000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\INSTALLOPTIONS.DLL" at base 731d0000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\SYSTEM.DLL" at base 730e0000 "V3Medic.exe" loaded module "%TEMP%\NST3FC5.TMP\INSTALLOPTIONS.DLL" at base 730d0000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75b50000 "V3Medic.exe" loaded module "COMCTL32" at base 758c0000 "V3Medic.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76800000 "V3Medic.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76b70000 "V3Medic.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76b70000 "V3Medic.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 77740000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77ce0000 "V3Medic.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74000000 "V3Medic.exe" loaded module "USER32.DLL" at base 76b70000 "V3Medic.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base 72be0000 "V3Medic.exe" loaded module "CSCAPI.DLL" at base 74780000 "SysX64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd7f690000 "SysX64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd7f690000 "SysX64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd7f690000 "SysX64.exe" loaded module "KERNEL32" at base 7ffd803b0000 "SysX64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd5a820000 "SysX64.exe" loaded module "UXTHEME.DLL" at base 7ffd7c960000 "SysX64.exe" loaded module "USER32.DLL" at base 7ffd80a50000 "SysX64.exe" loaded module "DWMAPI.DLL" at base 7ffd7cd70000 "SysX64.exe" loaded module "MFC90ENU.DLL" at base 5d360000 "SysX64.exe" loaded module "%ALLUSERSPROFILE%\AHNLAB\AIS\SAFETRANSACTION\NZINST.DLL" at base 7ffd59590000 "SysX64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd6fb80000 "SysX64.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\STCTINSTENU.DLL" at base 0 "SysX64.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\STCTINSTLOC.DLL" at base 0 "SysX64.exe" loaded module "ADVAPI32.DLL" at base 7ffd81d70000 "SysX64.exe" loaded module "RPCRT4.DLL" at base 7ffd81c50000 "SysX64.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\STCTINST.DLL" at base 7ffd5a7b0000 "SysX64.exe" loaded module "KERNEL32.DLL" at base 7ffd803b0000 "SysX64.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd7e2f0000 "SysX64.exe" loaded module "NTDLL.DLL" at base 7ffd81f10000 "SysX64.exe" loaded module "KERNELBASE" at base 7ffd7f690000 "SysX64.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffd81320000 "SysX64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffd7c7c0000 "certutil.exe" loaded module "KERNEL32" at base 76ea0000 "certutil.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 777c0000 "certutil.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 777c0000 "certutil.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 777c0000 "certutil.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76740000 "certutil.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 777c0000 "certutil.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 777c0000 "certutil.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 777c0000 "certutil.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737c0000 "certutil.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75320000 "certutil.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 777c0000 "certutil.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CERT\NSS\SOFTOKN3.DLL" at base 72af0000 "certutil.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CERT\NSS\FREEBL3.DLL" at base 727f0000 "certutil.exe" loaded module "%APPDATA%\MOZILLA\FIREFOX\PROFILES\5XZ6UA91.DEFAULT-RELEASE/NSSCKBI.DLL" at base 0 "SysX64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd70150000 "SysX64.exe" loaded module "WINTRUST.DLL" at base 7ffd7f480000 "SysX64.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd7fba0000 "SysX64.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd7f610000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 18a46210000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd7f690000 "netsh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd7f690000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd7f690000 "netsh.exe" loaded module "KERNEL32" at base 7ffd803b0000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd70150000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffd7e380000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffd77e10000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7ffd81c50000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffd6fb60000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7ffd81e20000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ffd6faf0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffd604a0000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffd77980000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffd77950000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffd705e0000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffd77920000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ffd63830000 "netsh.exe" loaded module "NETPROFM.DLL" at base 7ffd7a990000 "netsh.exe" loaded module "NETSH.EXE" at base 7ff7ad030000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7ffd59bb0000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffd6fad0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ffd597c0000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7ffd594c0000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffd59780000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffd720b0000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffd5b210000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffd6fdf0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffd59430000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffd6afb0000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffd59e70000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffd593c0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffd806c0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd7c960000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7ffd76ad0000 "netsh.exe" loaded module "USERENV.DLL" at base 7ffd7e8f0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7ffd64120000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7ffd803b0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffd7f610000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ffd5ae80000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7ffd80200000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 1d3b0e60000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffd77e30000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffd77a00000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffd779f0000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffd77980000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffd77920000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffd720b0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 291e7680000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffd77a00000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffd75890000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ffd60460000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffd59480000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffd75860000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffd720b0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffd593f0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffd6fdf0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffd59380000 "SysX64.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\NZINST.DLL" at base 7ffd59bc0000 "ASDCli.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd7f690000 "ASDCli.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd7f690000 "ASDCli.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd7f690000 "ASDCli.exe" loaded module "KERNEL32" at base 7ffd803b0000 "ASDCli.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd70150000 "ASDCli.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd73a60000 "ASDCli.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd7e2f0000 "ASDCli.exe" loaded module "KERNEL32.DLL" at base 7ffd803b0000 "ASDCli.exe" loaded module "RPCRT4.DLL" at base 7ffd81c50000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\PDCFG.DLL" at base 7ffd5a7a0000 "ASDCli.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffd7f480000 "ASDCli.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd7fba0000 "ASDCli.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffd7c960000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CORE.DLL" at base 7ffd58c80000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CDMCTRL.DLL" at base 53900000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CDMAPI.DLL" at base 2cd0000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNCTLKD.DLL" at base 2d00000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ATAMPT.DLL" at base 7ffd59390000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFETR~1\AHNCTLKD.DLL" at base 2d00000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHAWKE.DLL" at base 10000000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AV.DLL" at base 7ffd59810000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CDMAPI.DLL" at base 2ce0000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNCTLKD.DLL" at base 2f20000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TSFLTCTL.DLL" at base 7ffd77980000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MEDCORE.DLL" at base 10000000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MEDEXT.DLL" at base 3680000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ASDI.DLL" at base 7ffd58be0000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MDP.DLL" at base 7ffd59290000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNCTLKD.DLL" at base 53900000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\FW.DLL" at base 7ffd58cb0000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNFWCT.DLL" at base 7ffd779a0000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\IPS.DLL" at base 7ffd593f0000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNHIPSCT.DLL" at base 7ffd779a0000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNNIPSCT.DLL" at base 7ffd779a0000 "ASDCli.exe" loaded module "IMM32.DLL" at base 7ffd80370000 "ASDCli.exe" loaded module "UXTHEME.DLL" at base 7ffd7c960000 "ASDCli.exe" loaded module "USER32.DLL" at base 7ffd80a50000 "ASDCli.exe" loaded module "DWMAPI.DLL" at base 7ffd7cd70000 "ASDCli.exe" loaded module "MFC90ENU.DLL" at base 3080000 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\NZPLUGINENU.DLL" at base 0 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\NZPLUGINLOC.DLL" at base 0 "ASDCli.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\NZPLUGIN.DLL" at base 7ffd592f0000 "ASDSvc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd7f690000 "ASDSvc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd7f690000 "ASDSvc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd7f690000 "ASDSvc.exe" loaded module "KERNEL32" at base 7ffd803b0000 "ASDSvc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd70150000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffd73a60000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffd7e2f0000 "ASDSvc.exe" loaded module "KERNEL32.DLL" at base 7ffd803b0000 "ASDSvc.exe" loaded module "RPCRT4.DLL" at base 7ffd81c50000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ASDI.DLL" at base 7ffd58be0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\PDCFG.DLL" at base 7ffd5a7a0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CORE.DLL" at base 7ffd58630000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32.DLL" at base 7ffd802f0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MEDCORE.DLL" at base 10000000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffd7f480000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 7ffd6a4a0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MED\DEFINITION\ATSTRUMT.DLL" at base 180000000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffd7fba0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MED\DEFINITION\LIBCRYPTO-1_1-X64.DLL" at base 2440000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MED\DEFINITION\LIBSSL-1_1-X64.DLL" at base 1fa0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\MEDEXT.DLL" at base 31f0000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffd7e7f0000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffd76290000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AMBASSMT.DLL" at base 7ffd58110000 "ASDSvc.exe" loaded module "SECUR32.DLL" at base 7ffd735b0000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffd77640000 "ASDSvc.exe" loaded module "IPHLPAPI.DLL" at base 7ffd7dea0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNI2.DLL" at base 7ffd593e0000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffd81320000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\BTSCNCTL.DLL" at base e60000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHAWKE.DLL" at base 11d0000 "ASDSvc.exe" loaded module "ADVAPI32.DLL" at base 7ffd81d70000 "ASDSvc.exe" loaded module "PSAPI.DLL" at base 7ffd80490000 "ASDSvc.exe" loaded module "NTDLL.DLL" at base 7ffd81f10000 "ASDSvc.exe" loaded module "KERNELBASE" at base 7ffd7f690000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffd7c7c0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\\ASDI.DLL" at base 7ffd58be0000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CDMCTRL.DLL" at base 53900000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\CDMAPI.DLL" at base 1080000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNCTLKD.DLL" at base 1210000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ATAMPT.DLL" at base 7ffd59390000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFETR~1\AHNCTLKD.DLL" at base 1210000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHNI2.DLL" at base 7ffd58310000 "ASDSvc.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\TNNETUTIL.DLL" at base 7ffd57f30000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\IPHLPAPI.DLL" at base 7ffd7dea0000 "ASDSvc.exe" loaded module "%WINDIR%\SYSTEM32\WTSAPI32.DLL" at base 7ffd78150000 "AKDVE.exe" loaded module "KERNEL32" at base 7ffd803b0000 "AKDVE.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffd7f690000 "AKDVE.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffd7f690000 "AKDVE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffd7f690000 "AKDVE.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffd7f690000 "AKDVE.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffd7f690000 "AKDVE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffd7f690000 "AKDVE.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd70150000 "AKDVE.exe" loaded module "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\AHAWKE.DLL" at base 10000000 "AKDVE.exe" loaded module "ADVAPI32.DLL" at base 7ffd81d70000 "AKDVE.exe" loaded module "RPCRT4.DLL" at base 7ffd81c5000062:T4a0,"astx_setup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77610000 "V3Medic.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77610000 "SysX64.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 7F610000 "certutil.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 7EC10000 "certutil.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 7F610000 "certutil.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77610000 "CheckNetIsolation.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 7EC10000 "CheckNetIsolation.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 7F610000 "SysX64.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 7EC10000 "netsh.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 7EC10000 "netsh.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 7F610000 "ASDCli.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 7F610000 "ASDCli.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 7EC10000 "ASDSvc.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 7F610000 "ASDSvc.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 7EC1000063:T138d,"astx_setup.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "astx_setup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "astx_setup.exe" was detected as "Microsoft Linker" and name: "Linker" "ASDUp.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ASDUp.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ASDUp.exe" was detected as "Microsoft Linker" and name: "Linker" "ASDCli.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ASDCli.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ASDCli.exe" was detected as "Microsoft Linker" and name: "Linker" "AupASD.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "AupASD.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AupASD.exe" was detected as "Microsoft Linker" and name: "Linker" "StSdk.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StSdk.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "StSdk.dll" was detected as "Microsoft Linker" and name: "Linker" "ASDSvc.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ASDSvc.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ASDSvc.exe" was detected as "Microsoft Linker" and name: "Linker" "ASDCr.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ASDCr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ASDCr.exe" was detected as "Microsoft Linker" and name: "Linker" "NzBrcom.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "NzBrcom.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NzBrcom.dll" was detected as "Microsoft Linker" and name: "Linker" "Mdp.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Mdp.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Mdp.dll" was detected as "Microsoft Linker" and name: "Linker" "SCTX.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "SCTX.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "SCTX.exe" was detected as "Microsoft Linker" and name: "Linker" "StSvr.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StSvr.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "StSvr.dll" was detected as "Microsoft Linker" and name: "Linker" "NzPlugin.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "NzPlugin.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NzPlugin.dll" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-1_1-x64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "libcrypto-1_1-x64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-1_1-x64.dll" was detected as "Microsoft Linker" and name: "Linker" "StCtl.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StCtl.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "StCtl.dll" was detected as "Microsoft Linker" and name: "Linker" "StCli.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StCli.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "StCli.exe" was detected as "Microsoft Linker" and name: "Linker" "ambassmt.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ambassmt.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ambassmt.dll" was detected as "Microsoft Linker" and name: "Linker" "TNNetUtil.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "TNNetUtil.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "TNNetUtil.dll" was detected as "Microsoft Linker" and name: "Linker" "StSdk32.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "StSdk32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "StSdk32.dll" was detected as "Microsoft Linker" and name: "Linker" "Atampt.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Atampt.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Atampt.dll" was detected as "Microsoft Linker" and name: "Linker" "NzBrcom32.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "NzBrcom32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NzBrcom32.dll" was detected as "Microsoft Linker" and name: "Linker" "V3INet4.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "V3INet4.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "V3INet4.dll" was detected as "Microsoft Linker" and name: "Linker"64:T6ab,Observed system executable string:"\Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe" [Source: 00000000-00002504-00000BC0-2072352128] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002504-00000BC0-2072354900] Observed system executable string:"%WINDIR%\system32\cmd.exe /C "ECHO Y| cacls %TEMP%\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)"" [Source: 00000000-00002504-00000C47-5499525348] Observed system executable string:"%WINDIR%\system32\cmd.exe /S /D /c" ECHO Y"" [Source: 00000000-00004292-00000C47-1631091248] Observed system executable string:"%WINDIR%\system32\cacls.exe" [Source: 00000000-00004292-00000C47-1668225400] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00004292-00000BC0-2072517036] Observed system executable string:"\Device\HarddiskVolume3\Windows\SysWOW64\cacls.exe" [Source: 00000000-00004292-00000BC0-2073286009] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\certutil.exe" [Source: 00000000-00001760-00000BC0-2150025869] Observed system executable string:"%WINDIR%\SYSTEM32\certutil.exe" [Source: 00000000-00001760-00000BC0-2150028491] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\CheckNetIsolation.exe" [Source: 00000000-00001760-00000BC0-2160711597] Observed system executable string:"%WINDIR%\SYSTEM32\CheckNetIsolation.exe" [Source: 00000000-00001760-00000BC0-2160713059] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\netsh.exe" [Source: 00000000-00006588-00000BC0-2163154413] Observed system executable string:"%WINDIR%\SYSTEM32\netsh.exe" [Source: 00000000-00006588-00000BC0-2163156986]65:Tb20,Process "cmd.exe" (UID: 00000000-00004292) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N"" Process "cmd.exe" (UID: 00000000-00004292) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "certutil.exe" (UID: 00000000-00008584) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "certutil.exe" (UID: 00000000-00008584) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "SysX64.exe" (UID: 00000000-00006588) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "SysX64.exe" (UID: 00000000-00006588) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "netsh.exe" (UID: 00000000-00005148) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "netsh.exe" (UID: 00000000-00005148) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "SysX64.exe" (UID: 00000000-00003492) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "SysX64.exe" (UID: 00000000-00003492) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "ASDCli.exe" (UID: 00000000-00003768) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "ASDCli.exe" (UID: 00000000-00003768) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "SysX64.exe" (UID: 00000000-00001348) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "SysX64.exe" (UID: 00000000-00001348) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "ASDCli.exe" (UID: 00000000-00005236) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "ASDCli.exe" (UID: 00000000-00005236) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "ASDSvc.exe" (UID: 00000000-00002180) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS" Process "ASDSvc.exe" (UID: 00000000-00002180) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, EFC_5604, OneDrive, USERDNSDOMAIN, HOMEPATH, HOMEDRIVE" Process "AKDVE.exe" (UID: 00000000-00006296) was launched with new environment variables: "USERDNSDOMAIN="WORKGROUP"" Process "AKDVE.exe" (UID: 00000000-00006296) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"66:T48d,"astx_setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "astx_setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "astx_setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "V3Medic.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "V3Medic.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "V3Medic.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SysX64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SysX64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SysX64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "SysX64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")67:Ta56,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00002504-00000C2B-2070494422] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00002504-00000C2B-2070534285] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00002504-00000C2B-2070583325] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00002504-00000C2B-2070688616] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00002504-00000C2B-2070730941] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00002504-00000C2B-2070770118] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00002504-00000C2B-2070808102] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00002504-00000C2B-2070858516] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00002504-00000C2B-2070896713] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00002504-00000C2B-2070935305] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00002504-00000C2B-2071138399] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00002504-00000C2B-2071185913] Observed system executable string:"%WINDIR%\system32\SHFolder.dll" [Source: 00000000-00005140-00000C2B-2095254351] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00005140-00000C2B-2096008140] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00005140-00000C2B-2108248423] Observed system executable string:"%WINDIR%\system32\Version.dll" [Source: 00000000-00003768-00000C2B-2181538886] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003768-00000C66-2181722617] Observed system executable string:"%WINDIR%\system32\wintrust.dll" [Source: 00000000-00003768-00000C2B-2181909631] Observed system executable string:"%WINDIR%\system32\crypt32.dll" [Source: 00000000-00003768-00000C2B-2182079157] Observed system executable string:"%WINDIR%\system32\Ws2_32.dll" [Source: 00000000-00002180-00000C2B-2229733369] Observed system executable string:"%WINDIR%\system32\msi.dll" [Source: 00000000-00002180-00000C2B-2230485772] Observed system executable string:"%WINDIR%\system32\iphlpapi.dll" [Source: 00000000-00002180-00000C2B-2239133836] Observed system executable string:"%WINDIR%\system32\Wtsapi32.dll" [Source: 00000000-00002180-00000C2B-2239312736]68:T917,Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /C "ECHO Y| cacls %TEMP%\\asfEA63.tm ..." (UID: 00000000-00004292), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" ECHO Y"" (UID: 00000000-00008048), Spawned process "cacls.exe" with commandline "cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)" (UID: 00000000-00004844), Spawned process "V3Medic.exe" (UID: 00000000-00005140), Spawned process "SysX64.exe" (UID: 00000000-00003560), Spawned process "SysX64.exe" (UID: 00000000-00009068), Spawned process "SysX64.exe" (UID: 00000000-00007544), Spawned process "SysX64.exe" (UID: 00000000-00001760), Spawned process "certutil.exe" with commandline "certutil -addstore -f root "%PROGRAMFILES%\\AhnLab\\Safe Transac ..." (UID: 00000000-00008584) Spawned process "certutil.exe" with commandline "certutil -repairstore root 9c786262fd7479bd "%PROGRAMFILES%\\Ahn ..." (UID: 00000000-00004516), Spawned process "certutil.exe" with commandline ""%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil" ..." (UID: 00000000-00001180), Spawned process "certutil.exe" with commandline ""%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil" ..." (UID: 00000000-00008084), Spawned process "CheckNetIsolation.exe" with commandline "LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe" (UID: 00000000-00001448), Spawned process "SysX64.exe" (UID: 00000000-00006588), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall set rule name="AhnLab Safe Transactio ..." (UID: 00000000-00005148) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="AhnLab Safe Transac ..." (UID: 00000000-00000772), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="AhnLab Safe Transactio ..." (UID: 00000000-00007924) Spawned process "SysX64.exe" (UID: 00000000-00003492) Spawned process "ASDCli.exe" with commandline "/register" (UID: 00000000-00003768) Spawned process "SysX64.exe" (UID: 00000000-00001348) Spawned process "SysX64.exe" (UID: 00000000-00000976) Spawned process "SysX64.exe" (UID: 00000000-00008700) Spawned process "SysX64.exe" (UID: 00000000-00003664) Spawned process "SysX64.exe" (UID: 00000000-00003968) Spawned process "SysX64.exe" (UID: 00000000-00006240)69:T917,Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /C "ECHO Y| cacls %TEMP%\\asfEA63.tm ..." (UID: 00000000-00004292), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" ECHO Y"" (UID: 00000000-00008048), Spawned process "cacls.exe" with commandline "cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)" (UID: 00000000-00004844), Spawned process "V3Medic.exe" (UID: 00000000-00005140), Spawned process "SysX64.exe" (UID: 00000000-00003560), Spawned process "SysX64.exe" (UID: 00000000-00009068), Spawned process "SysX64.exe" (UID: 00000000-00007544), Spawned process "SysX64.exe" (UID: 00000000-00001760), Spawned process "certutil.exe" with commandline "certutil -addstore -f root "%PROGRAMFILES%\\AhnLab\\Safe Transac ..." (UID: 00000000-00008584) Spawned process "certutil.exe" with commandline "certutil -repairstore root 9c786262fd7479bd "%PROGRAMFILES%\\Ahn ..." (UID: 00000000-00004516), Spawned process "certutil.exe" with commandline ""%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil" ..." (UID: 00000000-00001180), Spawned process "certutil.exe" with commandline ""%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil" ..." (UID: 00000000-00008084), Spawned process "CheckNetIsolation.exe" with commandline "LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe" (UID: 00000000-00001448), Spawned process "SysX64.exe" (UID: 00000000-00006588), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall set rule name="AhnLab Safe Transactio ..." (UID: 00000000-00005148) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="AhnLab Safe Transac ..." (UID: 00000000-00000772), Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="AhnLab Safe Transactio ..." (UID: 00000000-00007924) Spawned process "SysX64.exe" (UID: 00000000-00003492) Spawned process "ASDCli.exe" with commandline "/register" (UID: 00000000-00003768) Spawned process "SysX64.exe" (UID: 00000000-00001348) Spawned process "SysX64.exe" (UID: 00000000-00000976) Spawned process "SysX64.exe" (UID: 00000000-00008700) Spawned process "SysX64.exe" (UID: 00000000-00003664) Spawned process "SysX64.exe" (UID: 00000000-00003968) Spawned process "SysX64.exe" (UID: 00000000-00006240)6a:T7a66,"Core.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Core.dll]- [targetUID: 00000000-00003768] "Fw.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Fw.dll]- [targetUID: 00000000-00003768] "ASDi.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDi.dll]- [targetUID: 00000000-00003768] "StSess.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSess.exe]- [targetUID: 00000000-00005140] "ASDUp.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDUp.exe]- [targetUID: 00000000-00005140] "ASDCli.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDCli.exe]- [targetUID: 00000000-00005140] "AupASD.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AupASD.exe]- [targetUID: 00000000-00005140] "StSdk.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk.dll]- [targetUID: 00000000-00006240] "ASDSvc.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDSvc.exe]- [targetUID: 00000000-00005140] "ASDCr.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDCr.exe]- [targetUID: 00000000-00005140] "NzBrcom.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom.dll]- [targetUID: 00000000-00006240] "Mdp.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mdp.dll]- [targetUID: 00000000-00003768] "SCTX.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\SCTX.exe]- [targetUID: 00000000-00005140] "StSvr.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSvr.dll]- [targetUID: 00000000-00005140] "NzPlugin.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzPlugin.dll]- [targetUID: 00000000-00003768] "libcrypto-1_1-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libcrypto-1_1-x64.dll]- [targetUID: 00000000-00005140] "StCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtl.dll]- [targetUID: 00000000-00006240] "StCli.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCli.exe]- [targetUID: 00000000-00005140] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\ambassmt.dll]- [targetUID: 00000000-00005140] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ambassmt.dll]- [targetUID: 00000000-00005140] "TNNetUtil.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TNNetUtil.dll]- [targetUID: 00000000-00005140] "StSdk32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk32.dll]- [targetUID: 00000000-00006240] "Atampt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Atampt.dll]- [targetUID: 00000000-00003768] "NzBrcom32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom32.dll]- [targetUID: 00000000-00006240] "V3INet4.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet4.dll]- [targetUID: 00000000-00005140] "medcore.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medcore.dll]- [targetUID: 00000000-00003768] "AtamptU.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AtamptU.dll]- [targetUID: 00000000-00005140] "atstrumt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\atstrumt.dll]- [targetUID: 00000000-00006240] "Ips.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Ips.dll]- [targetUID: 00000000-00003768] "StCtl32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtl32.dll]- [targetUID: 00000000-00006240] "AhnIEx.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\AhnIEx.dll]- [targetUID: 00000000-00005140] "V3INet3.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet3.dll]- [targetUID: 00000000-00005140] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\sqlite3.dll]- [targetUID: 00000000-00005140] "atstrust.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\atstrust.dll]- [targetUID: 00000000-00005140] "V3Medic.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\asfEA63.tmp\V3Medic.exe]- [targetUID: 00000000-00005140] "V3Medic.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3Medic.exe]- [targetUID: 00000000-00005140] "Av.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Av.dll]- [targetUID: 00000000-00003768] "ASDWsc.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDWsc.exe]- [targetUID: 00000000-00005140] "medvphku.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvphku.dll]- [targetUID: 00000000-00005140] "AhnIEx.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsuE86E.tmp\AhnIEx.dll]- [targetUID: 00000000-00005140] "Ark64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Ark64.dll]- [targetUID: 00000000-00005140] "medext.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medext.dll]- [targetUID: 00000000-00003768] "NzInst.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzInst.dll]- [targetUID: 00000000-00009068] "trueeyesu.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\nst3FC5.tmp\e\trueeyesu.dll]- [targetUID: 00000000-00005140] "UpEx.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\UpEx.dll]- [targetUID: 00000000-00005140] "HsbCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\HsbCtl.dll]- [targetUID: 00000000-00003768] "NzInst32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzInst32.dll]- [targetUID: 00000000-00005140] "medvphkuw6.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvphkuw6.dll]- [targetUID: 00000000-00005140] "PdCfg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\PdCfg.dll]- [targetUID: 00000000-00003768] "StSess32.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSess32.exe]- [targetUID: 00000000-00005140] "StCtInst.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtInst.dll]- [targetUID: 00000000-00005140] "powapi.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\powapi.dll]- [targetUID: 00000000-00005140] "HsbCtl32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\HsbCtl32.dll]- [targetUID: 00000000-00006240] "libssl-1_1-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libssl-1_1-x64.dll]- [targetUID: 00000000-00005140] "V3Cert.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3Cert.dll]- [targetUID: 00000000-00005140] "ahloha.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ahloha.dll]- [targetUID: 00000000-00005140] "Ark64lgplv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Ark64lgplv2.dll]- [targetUID: 00000000-00005140] "ScrMon32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ScrMon32.dll]- [targetUID: 00000000-00006240] "aostrust.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\aostrust.dll]- [targetUID: 00000000-00005140] "freebl3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\freebl3.dll]- [targetUID: 00000000-00005140] "powapi32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\powapi32.dll]- [targetUID: 00000000-00005140] "nss3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nss3.dll]- [targetUID: 00000000-00005140] "AI7z20.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\AI7z20.dll]- [targetUID: 00000000-00005140] "mkd25.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25.dll]- [targetUID: 00000000-00006240] "AhnUp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnUp.dll]- [targetUID: 00000000-00005140] "aostrust32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\aostrust32.dll]- [targetUID: 00000000-00005140] "nssckbi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nssckbi.dll]- [targetUID: 00000000-00005140] "mkd25def64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25def64.dll]- [targetUID: 00000000-00006240] "mkd2564.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd2564.dll]- [targetUID: 00000000-00006240] "ssl3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ssl3.dll]- [targetUID: 00000000-00005140] "TSFltCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TSFltCtl.dll]- [targetUID: 00000000-00003768] "mkd25def.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25def.dll]- [targetUID: 00000000-00006240] "softokn3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\softokn3.dll]- [targetUID: 00000000-00005140] "libnspr4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libnspr4.dll]- [targetUID: 00000000-00005140] "RestoreU.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\nst3FC5.tmp\e\RestoreU.exe]- [targetUID: 00000000-00005140] "libacm.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libacm.dll]- [targetUID: 00000000-00006240] "asc_main.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\asc_main.dll]- [targetUID: 00000000-00005140] "MUpdate2.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\nst3FC5.tmp\e\MUpdate2.exe]- [targetUID: 00000000-00005140] "mkd25sdk.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25sdk.dll]- [targetUID: 00000000-00006240] "AhnI2t.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\AhnI2t.dll]- [targetUID: 00000000-00005140] "CdmAPI.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\CdmAPI.dll]- [targetUID: 00000000-00003768] "tnnipsct.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnnipsct.dll]- [targetUID: 00000000-00003768] "tnfwct.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnfwct.dll]- [targetUID: 00000000-00003768] "tnhipsct.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnhipsct.dll]- [targetUID: 00000000-00003768] "SysARM64.exe" has type "PE32+ executable for MS Windows 6.02 (console) ARM64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\SysARM64.exe]- [targetUID: 00000000-00005140] "AhnUpCtl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnUpCtl.dll]- [targetUID: 00000000-00005140] "V3Hunt.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3Hunt.dll]- [targetUID: 00000000-00005140] "certutil.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\certutil.exe]- [targetUID: 00000000-00005140] "nssutil3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nssutil3.dll]- [targetUID: 00000000-00005140] "tsPatcha.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tsPatcha.dll]- [targetUID: 00000000-00005140] "smime3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\smime3.dll]- [targetUID: 00000000-00005140] "nssdbm3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nssdbm3.dll]- [targetUID: 00000000-00005140] "AhnI2.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnI2.dll]- [targetUID: 00000000-00006240] "SysX64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\nst3FC5.tmp\SysX64.exe]- [targetUID: 00000000-00003768] "tsmime.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tsmime.dll]- [targetUID: 00000000-00005140] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\vcruntime140.dll]- [targetUID: 00000000-00005140] "mkd25sdk64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25sdk64.dll]- [targetUID: 00000000-00006240] "CdmCtrl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\CdmCtrl.dll]- [targetUID: 00000000-00003768] "V3ElamCt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3ElamCt.dll]- [targetUID: 00000000-00005140] "WinFWMgr.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\WinFWMgr.dll]- [targetUID: 00000000-00005140] "IAccessible2Proxy.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\IAccessible2Proxy.dll]- [targetUID: 00000000-00006240] "mspatcha.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mspatcha.dll]- [targetUID: 00000000-00005140] "V3INet2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet2.dll]- [targetUID: 00000000-00005140] "AhnCtlKd.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnCtlKd.dll]- [targetUID: 00000000-00003768] "IAccessible2Proxy32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\IAccessible2Proxy32.dll]- [targetUID: 00000000-00006240] "BtScnCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\BtScnCtl.dll]- [targetUID: 00000000-00005140] "libplc4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libplc4.dll]- [targetUID: 00000000-00005140] "InstallOptions.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\InstallOptions.dll]- [targetUID: 00000000-00005140] "libplds4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libplds4.dll]- [targetUID: 00000000-00005140] "System.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsuE86E.tmp\System.dll]- [targetUID: 00000000-00005140] "nsExec.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsuE86E.tmp\nsExec.dll]- [targetUID: 00000000-00002504] "Uninstall AhnLab Safe Transaction.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Has command line arguments Icon number=0 Unicoded HasExpIcon "%SystemDrive%\Program Files\AhnLab\Safe Transaction\V3Medic.exe" MachineID mzx5vtjpolct2jy Archive ctime=Wed Jan 7 17:11:11 2026 atime=Wed Jan 7 17:11:11 2026 mtime=Mon Nov 24 07:49:17 2025 length=2209888 window=normal IDListSize 0x01db Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\AhnLab\Safe Transaction\V3Medic.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\AhnLab\AhnLab Safe Transaction\Uninstall AhnLab Safe Transaction.lnk]- [targetUID: 00000000-00005140] "Settings.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Has command line arguments Icon number=3 Unicoded HasExpIcon "%SystemDrive%\Program Files\AhnLab\Safe Transaction\StSess.exe" MachineID mzx5vtjpolct2jy Archive ctime=Wed Jan 7 17:11:16 2026 atime=Wed Jan 7 17:11:57 2026 mtime=Sun Nov 23 15:00:43 2025 length=8842768 window=normal IDListSize 0x01d9 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\AhnLab\Safe Transaction\StSess.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\AhnLab\AhnLab Safe Transaction\Settings.lnk]- [targetUID: 00000000-00005140] "AhnLab Safe Transaction.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%SystemDrive%\Program Files\AhnLab\Safe Transaction\StCli.exe" MachineID mzx5vtjpolct2jy Archive ctime=Wed Jan 7 17:11:15 2026 atime=Wed Jan 7 17:11:15 2026 mtime=Sun Nov 23 15:02:34 2025 length=4047888 window=normal IDListSize 0x01d5 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\AhnLab\Safe Transaction\StCli.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\AhnLab\AhnLab Safe Transaction\AhnLab Safe Transaction.lnk]- [targetUID: 00000000-00005140] "AhnLab Report.lnk" has type "MS Windows shortcut Item id list present Icon number=0 Unicoded length=0 window=normal IDListSize 0x008c Root folder "871C5380-42A0-1069-A2EA-08002B30309D""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\AhnLab\AhnLab Safe Transaction\AhnLab Report.lnk]- [targetUID: 00000000-00005140] "ASTX_Common.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_Common.nz]- [targetUID: 00000000-00005140] "med_x64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\Engine\med_x64.nz]- [targetUID: 00000000-00005140] "ASTX_X64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_X64.nz]- [targetUID: 00000000-00005140] "Core_NT32.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\Core_NT32.nz]- [targetUID: 00000000-00002504] "ASTX_ARM64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_ARM64.nz]- [targetUID: 00000000-00002504] "Core_ARM64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\Core_ARM64.nz]- [targetUID: 00000000-00002504] "Core_X64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\Core_X64.nz]- [targetUID: 00000000-00005140] "ASTX_NT32.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_NT32.nz]- [targetUID: 00000000-00002504] "med_nt32.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\Engine\med_nt32.nz]- [targetUID: 00000000-00005140] "Fw_ARM64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Fw_ARM64.nz]- [targetUID: 00000000-00002504] "Fw_X64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Fw_X64.nz]- [targetUID: 00000000-00005140] "Fw_NT32.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Fw_NT32.nz]- [targetUID: 00000000-00002504] "med_arm64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\Engine\med_arm64.nz]- [targetUID: 00000000-00005140] "med_com.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\Engine\med_com.nz]- [targetUID: 00000000-00005140] "ASTX_Install_X64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_Install_X64.nz]- [targetUID: 00000000-00005140] "ASTX_Install_ARM64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_Install_ARM64.nz]- [targetUID: 00000000-00002504] "Update.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\Update.nz]- [targetUID: 00000000-00005140] "ASTX_Install_NT32.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_Install_NT32.nz]- [targetUID: 00000000-00005140] "ckw_X64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ckw_X64.nz]- [targetUID: 00000000-00005140] "ckw_NT32.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ckw_NT32.nz]- [targetUID: 00000000-00002504] "ckw_ARM64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\ckw_ARM64.nz]- [targetUID: 00000000-00002504] "medcored.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medcored.sys]- [targetUID: 00000000-00005140] "Mdp_X64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Mdp_X64.nz]- [targetUID: 00000000-00005140] "Mdp_ARM64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Mdp_ARM64.nz]- [targetUID: 00000000-00002504] "medvpdrv.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvpdrv.sys]- [targetUID: 00000000-00005140] "Mdp_NT32.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Mdp_NT32.nz]- [targetUID: 00000000-00002504] "Ips_X64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Ips_X64.nz]- [targetUID: 00000000-00005140] "Ips_ARM64.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Ips_ARM64.nz]- [targetUID: 00000000-00002504] "Ips_NT32.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\Ips_NT32.nz]- [targetUID: 00000000-00002504] "AtamptNt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AtamptNt.sys]- [targetUID: 00000000-00005140] "Av_X64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\Av_X64.nz]- [targetUID: 00000000-00005140] "TSFltDrv.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TSFltDrv.sys]- [targetUID: 00000000-00005140] "Av_ARM64.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\Av_ARM64.nz]- [targetUID: 00000000-00002504] "Av_NT32.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\Av_NT32.nz]- [targetUID: 00000000-00002504] "AMonCDW8.sys" has type "PE32+ executable for MS Windows 6.02 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonCDW8.sys]- [targetUID: 00000000-00005140] "AMonCDW7.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonCDW7.sys]- [targetUID: 00000000-00005140] "tnhipsnt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnhipsnt.sys]- [targetUID: 00000000-00005140] "mkd3kfnt.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd3kfnt.sys]- [targetUID: 00000000-00005140] "tnfwnt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnfwnt.sys]- [targetUID: 00000000-00005140] "tnnipsnt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnnipsnt.sys]- [targetUID: 00000000-00005140] "libakcm.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libakcm.sys]- [targetUID: 00000000-00005140] "TFFREGNT.SYS" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TFFREGNT.SYS]- [targetUID: 00000000-00005140] "Mkd2Nadr.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mkd2Nadr.sys]- [targetUID: 00000000-00005140] "AHAWKE.DLL" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AHAWKE.DLL]- [targetUID: 00000000-00003768] "HsbDrv64.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\HsbDrv64.sys]- [targetUID: 00000000-00005140] "AKDVE.EXE" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AKDVE.EXE]- [targetUID: 00000000-00005140] "AMonTDNt.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonTDNt.sys]- [targetUID: 00000000-00005140] "AMonTDLH.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonTDLH.sys]- [targetUID: 00000000-00005140] "Mkd2bthf.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mkd2bthf.sys]- [targetUID: 00000000-00005140] "key4.db-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db-journal]- [targetUID: 00000000-00001180] "Cdm2DrNt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Cdm2DrNt.sys]- [targetUID: 00000000-00005140] "ASTX_Res.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ASTX_Res.nz]- [targetUID: 00000000-00005140] "AMonHKNT.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonHKNT.sys]- [targetUID: 00000000-00005140] "AhnRghNt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnRghNt.sys]- [targetUID: 00000000-00005140] "AHAWKENT.SYS" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AHAWKENT.SYS]- [targetUID: 00000000-00005140] "AMonLWLH.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonLWLH.sys]- [targetUID: 00000000-00005140] "medvphkd.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvphkd.sys]- [targetUID: 00000000-00005140] "ALWFCtrl.Dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ALWFCtrl.Dll]- [targetUID: 00000000-00005140] "V3ElamDr.sys" has type "PE32+ executable for MS Windows 6.02 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3ElamDr.sys]- [targetUID: 00000000-00005140] "asdahc.nz" has type "7-zip archive data version 0.3"- Location: [%TEMP%\asfEA63.tmp\_Setup\asdahc.nz]- [targetUID: 00000000-00005140] "log.db-journal" has type "SQLite Rollback Journal"- Location: [%PROGRAMFILES%\AhnLab\Safe Transaction\DB\log.db-journal]- [targetUID: 00000000-00002180] "key4.db-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db-journal]- [targetUID: 00000000-00001180] "cfg.db-journal" has type "SQLite Rollback Journal"- Location: [%PROGRAMFILES%\AhnLab\Safe Transaction\DB\cfg.db-journal]- [targetUID: 00000000-00003768] "ckw_DATA.nz" has type "7-zip archive data version 0.4"- Location: [%TEMP%\asfEA63.tmp\_Setup\ckw_DATA.nz]- [targetUID: 00000000-00005140] "tnnfwrul.pec-journal" has type "SQLite Rollback Journal"- [targetUID: N/A] "cloud.db-journal" has type "SQLite Rollback Journal"- [targetUID: N/A] "nzdefcfg.db-journal" has type "SQLite Rollback Journal"- Location: [%PROGRAMFILES%\AhnLab\Safe Transaction\DB\nzdefcfg.db-journal]- [targetUID: 00000000-00008168]6b:T4c2,"astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "astx_setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")6c:T1020,"Core.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Core.dll]- [targetUID: 00000000-00003768] "Fw.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Fw.dll]- [targetUID: 00000000-00003768] "ASDi.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDi.dll]- [targetUID: 00000000-00003768] "StSdk.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk.dll]- [targetUID: 00000000-00006240] "NzBrcom.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom.dll]- [targetUID: 00000000-00006240] "Mdp.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mdp.dll]- [targetUID: 00000000-00003768] "StSvr.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSvr.dll]- [targetUID: 00000000-00005140] "NzPlugin.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzPlugin.dll]- [targetUID: 00000000-00003768] "libcrypto-1_1-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libcrypto-1_1-x64.dll]- [targetUID: 00000000-00005140] "StCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtl.dll]- [targetUID: 00000000-00006240] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\ambassmt.dll]- [targetUID: 00000000-00005140] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ambassmt.dll]- [targetUID: 00000000-00005140] "TNNetUtil.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TNNetUtil.dll]- [targetUID: 00000000-00005140] "StSdk32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk32.dll]- [targetUID: 00000000-00006240] "Atampt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Atampt.dll]- [targetUID: 00000000-00003768] "NzBrcom32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom32.dll]- [targetUID: 00000000-00006240] "V3INet4.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet4.dll]- [targetUID: 00000000-00005140] "medcore.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medcore.dll]- [targetUID: 00000000-00003768] "AtamptU.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AtamptU.dll]- [targetUID: 00000000-00005140] "atstrumt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\atstrumt.dll]- [targetUID: 00000000-00006240] "Ips.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Ips.dll]- [targetUID: 00000000-00003768] "StCtl32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtl32.dll]- [targetUID: 00000000-00006240] "AhnIEx.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\AhnIEx.dll]- [targetUID: 00000000-00005140] "V3INet3.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet3.dll]- [targetUID: 00000000-00005140] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\sqlite3.dll]- [targetUID: 00000000-00005140]6d:Taa4,"astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "ASTX_SETUP.EXE"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "")6e:T486,"astx_setup.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_42d541138da2ebd2\comctl32.dll" "astx_setup.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "astx_setup.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "astx_setup.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "astx_setup.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "astx_setup.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll" "astx_setup.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "astx_setup.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "astx_setup.exe" trying to touch file "\Global??\FltMgrMsg" "astx_setup.exe" trying to touch file "C:\WINDOWS\system32\UXTHEME.dll" "astx_setup.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "astx_setup.exe" trying to touch file "C:\WINDOWS\system32\USERENV.dll" "astx_setup.exe" trying to touch file "C:\Windows\SysWOW64\userenv.dll" "astx_setup.exe" trying to touch file "C:\WINDOWS\system32\APPHELP.dll" "astx_setup.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll"6f:T532,"V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC\X86" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC\X64" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\DB" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\Temp" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\MUpdate2" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\NetRule" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC\product.dat.ahc" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcp90.dll.ahc" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC\X64\msvcr90.dll.ahc" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcp90.dll.ahc" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\AHC\X86\msvcr90.dll.ahc" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\aos.sld" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\DB\defcfg.db" "V3Medic.exe" touched file "C:\Program Files\AhnLab\Safe Transaction\DB\ipcntry.db"70:T61c,"astx_setup.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp\AhnIEx.dll" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp\System.dll" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp\nsExec.dll" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\V3Medic.exe" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\certadm.dll" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\certutil_.exe" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\freebl3.dll" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libnspr4.dll" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplc4.dll" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\libplds4.dll" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nss3.dll" "V3Medic.exe" trying to access non-existent file "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\nssckbi.dll"71:T644,"astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp\NSIS.cat" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\AhnSec.dat" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\BldInfo.ini" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\Engine\med_arm64.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\Engine\med_com.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\Engine\med_nt32.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\Engine\med_x64.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\_Setup\ASTX_ARM64.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\_Setup\ASTX_Common.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\_Setup\ASTX_Install_ARM64.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\_Setup\ASTX_Install_NT32.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\_Setup\ASTX_Install_X64.nz" "astx_setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\_Setup\ASTX_NT32.nz"72:T1aa6,Found string "..\..\Src\openssl-3.0.12\crypto\objects\obj_dat.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\init.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\stack\stack.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\pkcs7\pk7_asn1.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\x509\x509_lu.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\x509\x509_vpm.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\initthread.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\bio\bio_lib.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\bio\bss_file.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\evp\digest.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\evp\evp_lib.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\asn1\tasn_dec.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\asn1\tasn_enc.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\asn1\tasn_new.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\asn1\tasn_fre.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\asn1\a_object.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\objects\obj_lib.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\x509\x509name.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\x509\x509_cmp.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\pkcs7\pk7_lib.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "u:\ahnlab\common\supdate\opensrc\openssl\opensrc\3.0\trunk\src\openssl-3.0.12\crypto\err\err_local.h" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\err\err.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\x509\x509_att.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\asn1\a_time.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "..\..\Src\openssl-3.0.12\crypto\x509\x_crl.c" (Indicator: "openssl-"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")73:T11ae,file/memory contains long string with (Indicator: " connect "; File: "V3INet2.dll") Found reference to API "Attempt to write encrypted data to underlying socket failed." (Indicator: " socket "; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found reference to API "[ConnectionCloseThreadProc] Invalid shutdown event" (Indicator: " shutdown "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[ConnectionCloseThreadProc] Receieve Shutdown event" (Indicator: " shutdown "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[ConnectionCloseThreadProc] (%p) socket fail(%d)" (Indicator: " socket "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WorkerThreadProc] setsockopt SO_UPDATE_ACCEPT_CONTEXT fail, WSAGetLastError=%d" (Indicator: "wsagetlasterror"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[MakeServerPool] socket fail, ret=%d" (Indicator: " socket "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WebServerStart] WSAStartup Failed(%d)" (Indicator: "wsastartup"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WebServerStart] Socket version not exist" (Indicator: " socket "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WebServerStart] socket Failed(%d)" (Indicator: " socket "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WebServerStart] setsockopt SO_CONDITIONAL_ACCEPT fail, WSAGetLastError=%d" (Indicator: "wsagetlasterror"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WebServerStart] bind Failed(%d)" (Indicator: " bind "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[WebServerStart] listen Failed(%d)" (Indicator: " listen "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SSLAcceptLocal, accept success" (Indicator: " accept "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "SSLConnectWeb, socket Fail ret=%u" (Indicator: " socket "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "ConnectToWeb, connect Fail, Err=%d" (Indicator: " connect "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "LocalRead, recv success overlapped=%p(%p)" (Indicator: " recv "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "LocalRead, recv fail, ret=%d(%p)" (Indicator: " recv "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebWrite, send success, len=%d, overlapped=%p(%p)" (Indicator: " send "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebWrite, send fail, WSAGetLastError=%d(%p)" (Indicator: "wsagetlasterror"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebWrite, send fail, WSAGetLastError=%d(%p)" (Indicator: " send "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebRead, recv success overlapped=%p(%p)" (Indicator: " recv "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebRead, recv fail, WSAGetLastError=%d(%p)" (Indicator: "wsagetlasterror"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WebRead, recv fail, WSAGetLastError=%d(%p)" (Indicator: " recv "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "LocalWrite, send success, len=%d, overlapped=%p(%p)" (Indicator: " send "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "LocalWrite, send fail, WSAGetLastError=%d(%p)" (Indicator: "wsagetlasterror"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "LocalWrite, send fail, WSAGetLastError=%d(%p)" (Indicator: " send "; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[CCommonController::ScheduleRescan] Failed to send message(%u)" (Indicator: " send "; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")74:Tf4a,Heuristic match: "mg.nr" Heuristic match: "v(.sg" Heuristic match: "shg>.iq" Heuristic match: "/).li" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "vh.pph/t!htph,drrhtnvva^_[]rpqqppppyy^_phdu;ut}vhxyytk9" Pattern match: "http://mozilla.org/mpl/2.0/.license" Pattern match: "update.ahnlab.com/loadmain.jsp%s/patch/%s%supdate\patch\%s\ahn.uic%sahn.uic[restoreu_updatefilesmain" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "http://ocsp.verisign.com0,0*0" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0qxhb%p?9s'q53v]?y:w!9ad+q" Pattern match: "crl.microsoft.com/pki/crl/products/cspca.crl0h" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0d^" Pattern match: "http://%s:%dv3inet2::can't" Pattern match: "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/" Pattern match: "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/.text$mn.idata$5.00cfg.crt$xca.crt$xcz.crt$xia.crt$xiz.crt$xpa.crt$xpz.crt$xta.crt$xtz.rdata.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$iaa.rtc$izz.rtc$taa.rtc$tzz.xdata$x.edata.idata$2.idata$3.idata$4" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0=heaub@nwcdtmf5]yq" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt0snx@,@%wwb1washington1redmond1microsoft" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt09" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0zn0l0j" Heuristic match: "gms001.ahnlab.com" Heuristic match: "get /jk?c=65&p=_y3t7dwtz_yd8va3sasrqz2_n0rtzcdjqcjwn4wlpca=&k=1 http/1.1accept: */*user-agent: medcoreconnection: keep-alivepragma: no-cachecookie: data=rjnmtsoohvk8rnz9xay25d8axg8obmaykvdxh8mdpyu=,+x5vzer43_wkwgp+qiiq1w==,mcflmp3cdak_bjpuhbx9w1ag+5_xltx5y" Heuristic match: "%windir%\system32\drivers\v3elamdr.cat" Heuristic match: "extract: v3elamdr.cat" Heuristic match: "%temp%\nst3fc5.tmp\e\v3elamdr.cat" Heuristic match: "extract: amonlwlh.cat" Heuristic match: "%temp%\nst3fc5.tmp\e\amonlwlh.cat" Heuristic match: "%programfiles%\ahnlab\safe transaction\amonlwlh.cat" Pattern match: "http://mozilla.org/mpl/2.0/" Pattern match: "http://www.mozilla.org/mpl/" Heuristic match: "pathext=.com;.exe;.bat;.cc" Pattern match: "http://svn.ahnlab.co.kr/project/medicine/framework/2.5/trunk/doc/02" Pattern match: "http://ispt.ahnlab.com/status" Pattern match: "https://tsc-relay.ahnlab.com/threat/windows/astx" Heuristic match: ".jse;.ws" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "www.virustotal.com" Heuristic match: "sb-ssl.google.com" Pattern match: "http://localhost:%u/"75:T419e,Found URL "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/" - Source: "00000000-00001180.00000000.202120.72B64000.00000002.mdmp") Found URL "http://svn.ahnlab.co.kr/project/medicine/framework/2.5/trunk/doc/02..xlsx" - Source: "00000000-00001760.00000000.201943.02D30000.00000004.mdmp") Found URL "http://ispt.ahnlab.com/statustscserverurl=https://tsc-relay.ahnlab.com/threat/windows/astxregioncode=1" - Source: "00000000-00001760.00000000.201943.02D30000.00000004.mdmp") Found URL "http://svn.ahnlab.co.kr/project/medicine/framework/2.5/trunk/doc/02..xlsx" - Source: "00000000-00002180.00000000.206903.016AE000.00000004.mdmp") Found URL "http://https://%s:%u%s:%u2.26.0.152.26.0.152.26.0.152.26.0.152.26.0.152.26.0.15unknown" - Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found URL "http://ns.adobe.com/xap/1.0/0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005140.00000000.198399.0040A000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005140.00000000.198399.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005140.00000001.200319.0040A000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00005140.00000001.200319.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005140.00000001.200319.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005140.00000001.200319.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005140.00000001.200319.0040A000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00005140.00000002.202240.00408000.00000002.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005140.00000002.202240.0040A000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00005140.00000002.202240.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00005140.00000002.202240.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005140.00000002.202240.0040A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005140.00000002.202240.0040A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00005236.00000000.206770.00FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005236.00000000.206770.0101A000.00000004.mdmp") Found URL "http://www.digicert.com/cps'yr*(y]*1yd*:yo*,fy+5f@+>fk+privatekeyinfo%g" - Source: "00000000-00005236.00000000.206770.030E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crtgreater" - Source: "00000000-00005236.00000000.206770.030E0000.00000004.mdmp") Found URL "http://svn.ahnlab.co.kr/project/medicine/framework/2.5/trunk/doc/02..xlsx" - Source: "00000000-00005236.00000000.206770.03107000.00000004.mdmp") Found URL "http://ispt.ahnlab.com/statustscserverurl=https://tsc-relay.ahnlab.com/threat/windows/astxregioncode=1" - Source: "00000000-00005236.00000000.206770.03107000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00005236.00000001.206803.00FC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005236.00000001.206803.0101A000.00000004.mdmp") Found URL "http://www.digicert.com/cps'yr*(y]*1yd*:yo*,fy+5f@+>fk+privatekeyinfo" - Source: "00000000-00005236.00000001.206803.030E0000.00000004.mdmp") Found URL "http://svn.ahnlab.co.kr/project/medicine/framework/2.5/trunk/doc/02..xlsx" - Source: "00000000-00005236.00000001.206803.03105000.00000004.mdmp") Found URL "http://ispt.ahnlab.com/statustscserverurl=https://tsc-relay.ahnlab.com/threat/windows/astxregioncode=1" - Source: "00000000-00005236.00000001.206803.03105000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00006588.00000000.202780.00570000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00006588.00000000.202780.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00006588.00000000.202780.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00006588.00000000.202780.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00006588.00000000.202780.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00006588.00000000.202780.005BD000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00006588.00000000.202780.005BD000.00000004.mdmp") Found URL "http://svn.ahnlab.co.kr/project/medicine/framework/2.5/trunk/doc/02..xlsx" - Source: "00000000-00006588.00000000.202780.02810000.00000004.mdmp") Found URL "http://ispt.ahnlab.com/statustscserverurl=https://tsc-relay.ahnlab.com/threat/windows/astxregioncode=1" - Source: "00000000-00006588.00000000.202780.02810000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00006588.00000001.203582.00570000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00006588.00000001.203582.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00006588.00000001.203582.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00006588.00000001.203582.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00006588.00000001.203582.00570000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00006588.00000001.203582.005BD000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00006588.00000001.203582.005BD000.00000004.mdmp") Found URL "http://mozilla.org/mpl/2.0/.http://www.mozilla.org/mpl/.text$mn.idata$5.00cfg.crt$xca.crt$xcz.crt$xia.crt$xiz.crt$xpa.crt$xpz.crt$xta.crt$xtz.rdata.rdata$sxdata.rdata$voltmd.rdata$zzzdbg.rtc$iaa.rtc$izz.rtc$taa.rtc$tzz.xdata$x.edata.idata$2.idata$3.idata$4.idata$6.data.bss.rsrc$01.rsrc$02libplds4.dllpl_arenaallocatepl_arenafinishpl_arenagrowpl_arenareleasepl_cleararenapoolpl_compactarenapoolpl_comparestringspl_comparevaluespl_finisharenapoolpl_freearenapoolpl_hashstringpl_hashtableaddpl_hashtabledestroypl_hashtabledumppl_hashtableenumerateentriespl_hashtablelookuppl_hashtablelookupconstpl_hashtablerawaddpl_hashtablerawlookuppl_hashtablerawlookupconstpl_hashtablerawremovepl_hashtableremovepl_initarenapoolpl_newhashtablepl_sizeofarenapoolexcludingpoollibversionpointpr_mallocpr_freepr_ceilinglog2libnspr4.dllqueryperformancecountergetcurrentprocessidgetcurrentthreadidgetsystemtimeasfiletimedisablethreadlibrarycallsinitializeslistheadisdebuggerpresentunhandledexceptionfiltersetunhandledexceptionfilterisprocessorfeaturepresentgetcurrentprocessterminateprocesskernel32.dllmemcpymemset__std_type_info_destroy_list_except_handler4_commonvcruntime140.dll_initterm_initterm_e_seh_filter_dll_configure_narrow_argv_initialize_narrow_environment_initialize_onexit_table_execute_onexit_table_cexitapi-ms-win-crt-runtime-l1-1-0.dll" - Source: "00000000-00008084.00000000.202442.72B53000.00000002.mdmp") Found URL "http://mozilla.org/mpl/2.0/.license" - Source: "00000000-00008084.00000000.202442.72B99000.00000002.mdmp") Found URL "http://www.mozilla.org/mpl/nspr_fd_cache_size_lownspr_fd_cache_size_highclosesocket" - Source: "00000000-00008084.00000000.202442.72B99000.00000002.mdmp") Found URL "http://get" - Source: "00000000-00008084.00000000.202442.72C0C000.00000002.mdmp") Found URL "http://svn.ahnlab.co.kr/project/medicine/framework/2.5/trunk/doc/02..xlsx" - Source: "00000000-00008168.00000000.206624.02C20000.00000004.mdmp") Found URL "http://ispt.ahnlab.com/statustscserverurl=https://tsc-relay.ahnlab.com/threat/windows/astxregioncode=1" - Source: "00000000-00008168.00000000.206624.02C20000.00000004.mdmp")76:T61b,YARA signature for AES encryption matched on file "SCTX.exe" YARA signature for AES encryption matched on file "mkd25.dll" YARA signature for AES encryption matched on process "00000000-00002180" YARA signature for AES encryption matched on process "00000000-00003768" YARA signature for AES encryption matched on file "medext.dll" YARA signature for AES encryption matched on file "V3INet3.dll" YARA signature for AES encryption matched on file "Mkd2Nadr.sys" YARA signature for AES encryption matched on file "medcored.sys" YARA signature for AES encryption matched on file "atstrumt.dll" YARA signature for AES encryption matched on file "tnfwct.dll" YARA signature for AES encryption matched on file "ASDCr.exe" YARA signature for AES encryption matched on file "AhnIEx.dll" YARA signature for AES encryption matched on file "Core.dll" YARA signature for AES encryption matched on file "StSvr.dll" YARA signature for AES encryption matched on file "Ark64lgplv2.dll" YARA signature for AES encryption matched on file "StSess32.exe" YARA signature for AES encryption matched on file "TNNetUtil.dll" YARA signature for AES encryption matched on file "tnnipsct.dll" YARA signature for AES encryption matched on file "Fw.dll" YARA signature for AES encryption matched on file "V3INet4.dll" YARA signature for AES encryption matched on file "StCtl32.dll" YARA signature for AES encryption matched on file "Atampt.dll" YARA signature for AES encryption matched on file "atstrust.dll" YARA signature for AES encryption matched on file "Mdp.dll"77:T5b2,Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "WTSEnumerateSessionsW" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[ERROR] WTSEnumerateSessionsW(%u)" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CIdleScanHelper::IsUserLogOff] WTSEnumerateSessionsW return FALSE" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CIdleScanHelper] WTSEnumerateSessionsW(%u)" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")78:Te8d,Found registry query API: "RegEnumKeyW" in file "astx_setup.exe" Found registry query API: "RegEnumValueW" in file "astx_setup.exe" Found registry query API: "RegQueryValueExW" in file "astx_setup.exe" Found registry query API: "RegOpenKeyExW" in file "astx_setup.exe" Found registry query API: "RegOpenKeyExW" in "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp" Found registry query API: "RegOpenCurrentUser" in "00000000-00002180.00000000.206903.10202000.00000002.mdmp" Found registry query API: "[CCommonController::GetRepumonLevelInfo] RegOpenKey (Ret:%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry query API: "[CEnumUserInfo::UpdateAllVariablesForRegistry] RegOpenKeyEx(%s), err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry query API: "[CEnumUserInfo::UpdateAllVariablesForRegistry] RegQueryInfoKey() err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry query API: "[CEnumUserInfo::UpdateAllVariablesForRegistry] RegEnumKeyEx(%s), err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry query API: "[EnumUserInfo::LoadProfilePath] RegQueryValue(%s), err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry query API: "[CEnumUserInfo::LoadProfilePath] RegEnumKeyEx(%s), err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp" Found registry query API: "[CEnumUserInfo::LoadProfilePath] RegQueryInfoKey(), err(%u)" in "00000000-00002180.00000000.206903.58A31000.00000002.mdmp"79:T636,"astx_setup.exe" called "FindFirstFileW" with parameter %TEMP%\nsuE86E.tmp (UID: 00000000-00002504) "astx_setup.exe" called "FindFirstFileW" with parameter %TEMP%\asfEA63.tmp (UID: 00000000-00002504) "astx_setup.exe" called "FindFirstFileW" with parameter %TEMP%\asfEA63.tmp\V3Medic.exe (UID: 00000000-00002504) "V3Medic.exe" called "FindFirstFileA" with parameter %ALLUSERSPROFILE%\AhnLab\{0D02314D-EC55-4D53-95FD-41183118B518}\amb.log (UID: 00000000-00005140) "V3Medic.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005140) "V3Medic.exe" called "FindNextFileW" with parameter med_arm64.nz (UID: 00000000-00005140) "V3Medic.exe" called "FindNextFileW" with parameter med_com.nz (UID: 00000000-00005140) "V3Medic.exe" called "FindNextFileW" with parameter med_nt32.nz (UID: 00000000-00005140) "V3Medic.exe" called "FindNextFileW" with parameter med_x64.nz (UID: 00000000-00005140) "V3Medic.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\AhnLab\Safe Transaction\DB (UID: 00000000-00005140) "V3Medic.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\AhnLab\Safe Transaction (UID: 00000000-00005140) "V3Medic.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\AhnLab (UID: 00000000-00005140) "V3Medic.exe" called "FindFirstFileW" with parameter C:\Program Files (UID: 00000000-00005140) "V3Medic.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\AhnLab\Safe Transaction\DefPly (UID: 00000000-00005140) "V3Medic.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\AhnLab\Safe Transaction\DB\*.* (UID: 00000000-00005140)7a:Tcb8,file/memory contains long string with (Indicator: "rsa2"; File: "certutil_.exe") file/memory contains long string with (Indicator: "aes"; File: "mkd25sdk.dll") file/memory contains long string with (Indicator: ".encrypt"; File: "mkd25sdk.dll") file/memory contains long string with (Indicator: "aes"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: "base64"; File: "nssdbm3.dll") file/memory contains long string with (Indicator: "base64"; File: "tsmime.dll") file/memory contains long string with (Indicator: "aes"; File: "mkd25sdk64.dll") file/memory contains long string with (Indicator: ".encrypt"; File: "mkd25sdk64.dll") file/memory contains long string with (Indicator: "base64"; File: "libplc4.dll") Found string "PL_Base64Decode" (Indicator: "base64"; Source: "00000000-00001180.00000000.202120.72B64000.00000002.mdmp") Found string "PL_Base64Encode" (Indicator: "base64"; Source: "00000000-00001180.00000000.202120.72B64000.00000002.mdmp") Found string "TLS_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "AES-GCM" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_CHACHA20_POLY1305_SHA256" (Indicator: "chacha"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "CHACHA20POLY1305" (Indicator: "chacha"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_AES_256_GCM_SHA384" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" (Indicator: "chacha"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_RSA_WITH_AES_256_CBC_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_RSA_WITH_AES_256_CBC_SHA" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found string "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp")7b:T836,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "astx_setup.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "astx_setup.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_CompareFileTimeW] FindFirstFileW failed(%d), %s" (Indicator: "FindFirstFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendCopyFile] FindFirstFileW failed(%d), %s" (Indicator: "FindFirstFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] FindFirstFileW failed(%d), %s" (Indicator: "FindFirstFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CCompressFileScanner::ScanDirAndFiles] FindFirstFile (Ret:%u) [path:%s]" (Indicator: "FindFirstFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::ScanDirectoryCB] FindFirstFile (Ret:%d) [Path:%s]" (Indicator: "FindFirstFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")7c:T1108,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "astx_setup.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "astx_setup.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "nsExec.dll") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "nsExec.dll") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001180.00000000.202120.72B31000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "[CUtilAMPPL::IsTargetProctectedProcess] fnNtQueryInformationProcess is NULL" (Indicator: "QueryInformationProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "UMStackWalk_Initialize, EnumProcessModulesEx init Failue." (Indicator: "EnumProcessModules"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp")7d:Ta7f,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "astx_setup.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "System.dll") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "nsExec.dll") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001180.00000000.202120.72B31000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[UHManager_EjectDllByRemoteThread] faild(pid:%d), BM_GetModuleHandleEx" (Indicator: "GetModuleHandle"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetModuleHandleW(kernel32.dll) failed(%d)" (Indicator: "GetModuleHandle"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")7e:Tb10,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "GetProcAddress"; File: "System.dll") file/memory contains long string with (Indicator: "GetProcAddress"; File: "nsExec.dll") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001180.00000000.202120.72B42000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "UMStackWalk_Initialize, GetProcAddress Wow64GetThreadContex Failue." (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[UHManager_InjectDllByRemoteThread] BM_GetProcAddressEx failed(%d), pid=%d" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[UHManager_EjectDllByRemoteThread] faild(pid:%d), BM_GetProcAddressEx" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(GetVersionExW) failed(%d)" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(CoInitialize) failed(%d)" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(CoUninitialize) failed(%d)" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(StringFromGUID2) failed(%d)" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(CreateVssBackupComponents) failed(%d)" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_InitFuncPointer] GetProcAddress(VssFreeSnapshotProperties) failed(%d)" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")7f:T1168,Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "astx_setup.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "astx_setup.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "astx_setup.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "astx_setup.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "astx_setup.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "astx_setup.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "astx_setup.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "astx_setup.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "GetTempFileName"; File: "nsExec.dll") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[ReProcessDirChangeThreadProc] ReadDirectoryChangesW failed (%d)" (Indicator: "ReadDirectoryChange"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "BuildingRansomwareMonitoringSystem, ReadDirectoryChangesW failed (%d)" (Indicator: "ReadDirectoryChange"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_Recall] GetFileAttributesW failed(%d), %s" (Indicator: "GetFileAttributes"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp")80:Ta5d,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "astx_setup.exe") Found reference to API "__vcrt_GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001180.00000000.202120.72B31000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001180.00000000.202120.72B42000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_GetModuleFilePath] GetModuleFileNameW failed(%d), %s" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendCopyFile] _GetModuleFileName failed(%d), %s, %s" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] _GetModuleFileName failed(%d), %s" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[INFO] [AhnFindModule] GetModuleFileName error(%d)" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[AhnFindModuleByFileName] GetModuleFileNameEx failed(%u)" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")81:T14f4,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "astx_setup.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "[CUtilAMPPL::IsTargetProctectedProcess] fnNtQueryInformationProcess is NULL" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[_GetCompatibilityToken] OpenProcessToken failed(%d)" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_GetCompatibilityToken] GetTokenInformation failed(%d)" (Indicator: "GetTokenInformation"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CNTProcessParamInfo::EnableTokenPrivilege] OpenProcessToken Failed!" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CNTProcessParamInfo::GetNtProcessDetailInfo] fnNtQueryInformationProcess is NULL" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CEnumUserInfo::EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcessToken"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[AhnProcessHelper::GetProcessUserNameFromToken] GetTokenInformation Failed 2, ErrCode(%lu)" (Indicator: "GetTokenInformation"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[AhnProcessHelper::GetProcessUserNameFromToken] LookupAccountSid Failed, ErrCode(%lu)" (Indicator: "LookupAccountSid"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[AhnProcessHelper::GetProcessUserNameFromToken] GetTokenInformation Failed 1, ErrCode(%lu)" (Indicator: "GetTokenInformation"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CUtilAMPPL::IsTargetProctectedProcess] fnNtQueryInformationProcess is NULL" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")82:Tf0a,Found string "Enter a password which will be used to encrypt your keys.The password should be at least %d characters long,and should consist of at least three character classes.The available character classes are: digits (0-9), ASCIIlowercase letters, ASCII upperca" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Enter a password which will be used to encrypt your keys.The password should be at least 8 characters long,and should contain at least one non-alphabetic character." (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Enter new password:" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Re-enter password:" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "No password file "%s" exists." (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "password file contains no data" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Incorrect password/PIN entered." (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Password check failed: No password found." (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Invalid password. Try again." (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Invalid password." (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Failed to change password." (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-20s Specify the password file" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "-f password-file" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Could not set password for the slot" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Could not get password for %s" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "Couldn't get password for %s" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "--empty-password" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-20s use empty password when creating a new database" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "-0 SSO-password" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-20s Set token's Site Security Officer password" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-15s Change the key database password" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-20s Specify a file with the current password" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-20s Specify a file with the new password in two lines" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-20s Specify the password file for the target database" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp") Found string "%-20s Specify the password file for the upgrade database" (Indicator: "password"; File: "00000000-00001180.00000000.202120.008C1000.00000020.mdmp")83:Td02,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "libnspr4.dll") file/memory contains long string with (Indicator: "OpenProcess"; File: "asc_main.dll") file/memory contains long string with (Indicator: "OpenProcess"; File: "V3ElamCt.dll") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found string "OpenProcess [pid: %d] Failure %d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found string "[UHManager_InjectDllByRemoteThread] OpenProcess failed(%d), pid=%d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found string "[UHManager_EjectDllByRemoteThread] faild(pid:%d), OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found string "DetectTimeDelayThreadProc, OpenProcess Failed. LastError = (%d), pid = (%d), dwDesiredAccess = (0x%x)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found string "[_GetCompatibilityToken] OpenProcessToken failed(%d)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found string "[CNTProcessParamInfo::EnableTokenPrivilege] OpenProcessToken Failed!" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found string "[CNTProcessParamInfo::GetNtProcessDetailInfo] OpenProcess Failed (PID:%u), (Ret:%u)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found string "[ERROR] [AhnFindModule] OpenProcess [PID:%d] dwErr=%d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found string "[INFO] [AhnFindModule] OpenProcess [PID:%d] dwErr=%d" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found string "[AhnFindModuleByFileName] OpenProcess [PID:%u] dwErr=%u" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found string "[CEnumUserInfo::EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found string "[EnableNTPrivilege] OpenProcessToken(), err(%u)" (Indicator: "OpenProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")84:T1650,Found string "\Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00002504-00000BC0-2072352128") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\V3Medic.exe" (Indicator: "\Device\"; Source: "00000000-00002504-00000BC0-2092562360") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00004292-00000BC0-2072517036") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\cacls.exe" (Indicator: "\Device\"; Source: "00000000-00004292-00000BC0-2073286009") Found string "system32\drivers\Mkd2Nadr.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC1-2096385908") Found string "system32\drivers\Mkd2Nadr.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC1-2096385908") Found string "%WINDIR%\system32\drivers\libakcm.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2125335308") Found string "%WINDIR%\system32\drivers\libakcm.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2125335308") Found string "%WINDIR%\system32\drivers\HsbDrv64.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2125399872") Found string "%WINDIR%\system32\drivers\HsbDrv64.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2125399872") Found string "%WINDIR%\system32\drivers\Mkd2bthf.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2125474345") Found string "%WINDIR%\system32\drivers\Mkd2bthf.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2125474345") Found string "%WINDIR%\system32\drivers\Mkd2Nadr.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2125497523") Found string "%WINDIR%\system32\drivers\Mkd2Nadr.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2125497523") Found string "%WINDIR%\system32\drivers\mkd3kfnt.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2125521269") Found string "%WINDIR%\system32\drivers\mkd3kfnt.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2125521269") Found string "%WINDIR%\system32\drivers\V3ElamDr.cat" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2128364645") Found string "%WINDIR%\system32\drivers\V3ElamDr.cat" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2128364645") Found string "%WINDIR%\system32\drivers\V3ElamDr.inf" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2128393054") Found string "%WINDIR%\system32\drivers\V3ElamDr.inf" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2128393054") Found string "%WINDIR%\system32\drivers\V3ElamDr.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2128425701") Found string "%WINDIR%\system32\drivers\V3ElamDr.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2128425701") Found string "%WINDIR%\system32\drivers\AMonLWLH.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2131921666") Found string "%WINDIR%\system32\drivers\AMonLWLH.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2131921666") Found string "%WINDIR%\system32\drivers\AhnRghNt.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2132154713") Found string "%WINDIR%\system32\drivers\AhnRghNt.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2132154713") Found string "%WINDIR%\system32\drivers\AMonCDW7.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2132193190") Found string "%WINDIR%\system32\drivers\AMonCDW7.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2132193190") Found string "%WINDIR%\system32\drivers\AMonCDW8.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2132230884") Found string "%WINDIR%\system32\drivers\AMonCDW8.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2132230884") Found string "%WINDIR%\system32\drivers\AMonHKNT.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2132264132") Found string "%WINDIR%\system32\drivers\AMonHKNT.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2132264132") Found string "%WINDIR%\system32\drivers\AMonTDLH.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2132299229") Found string "%WINDIR%\system32\drivers\AMonTDLH.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2132299229") Found string "%WINDIR%\system32\drivers\AMonTDNt.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2132350432") Found string "%WINDIR%\system32\drivers\AMonTDNt.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2132350432") Found string "%WINDIR%\system32\drivers\Cdm2DrNt.sys" (Indicator: "\drivers\"; Source: "00000000-00005140-00000BC0-2132394985") Found string "%WINDIR%\system32\drivers\Cdm2DrNt.sys" (Indicator: "system32\drivers"; Source: "00000000-00005140-00000BC0-2132394985") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\SysX64.exe" (Indicator: "\Device\"; Source: "00000000-00005140-00000BC0-2142828973") Found string "\Device\HarddiskVolume3\Windows\System32\certutil.exe" (Indicator: "\Device\"; Source: "00000000-00001760-00000BC0-2150025869") Found string "\Device\HarddiskVolume3\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe" (Indicator: "\Device\"; Source: "00000000-00001760-00000BC0-2150649896") Found string "\Device\HarddiskVolume3\Windows\System32\CheckNetIsolation.exe" (Indicator: "\Device\"; Source: "00000000-00001760-00000BC0-2160711597")85:T11bd,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "astx_setup.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "DeleteFile"; File: "nsExec.dll") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "UHManager_Start, DeleteFile (%s) failed. error = (%d)" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "UHManager_Stop, DeleteFile (%s) failed. error = (%d)" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_DeleteFileW] MoveFileExW failed(%d), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] ERROR_INVALID_PARAMETER failed(%d), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] ERROR_NOT_ENOUGH_MEMORY failed(%d), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] _GetModuleFileName failed(%d), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] FindFirstFileW failed(%d), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] FileAttributes(0x%08x), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] _GetCompatibilityFile(DIRECTORY), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] Delete File Cancelled(%d)" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] RemoveDirectoryW failed(%d), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] RemoveDirectoryW failed(%d), %s" (Indicator: "RemoveDirectory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] _GetCompatibilityFile(NORMAL), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[_ExtendDeleteFile] DeleteFileW failed(%d), %s" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CScannerContext::ScanProtectedFile] AhnDeleteFile (Ret:%d)" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::EraseFile] DeleteFile Success[filepath:%s]" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::EraseFile] DeleteFile (Ret:%d) [filepath:%s]" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CScannerContext::DeleteFileOnReboot] ReplaceFileOnReboot (%d)" (Indicator: "DeleteFile"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")86:Ta93,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "astx_setup.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "astx_setup.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "astx_setup.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CNTProcessParamInfo::EnableTokenPrivilege] AdjustTokenPrivileges Failed[%d]" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CEnumUserInfo::EnableNTPrivilege] AdjustTokenPrivileges(), err(%u)" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CEnumUserInfo::EnableNTPrivilege] LookupPrivilegeValue(), err(%u)" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[EnableNTPrivilege] AdjustTokenPrivileges(), err(%u)" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[EnableNTPrivilege] LookupPrivilegeValue(), err(%u)" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")87:T757,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "astx_setup.exe") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CPurgeLogs::PurgeDump] SetFileAttributes failed, %s, %d" (Indicator: "SetFileAttributes"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CPurgeLogs::PurgeDebugLog] SetFileAttributes failed, %s, %d" (Indicator: "SetFileAttributes"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CDumpHelper::CleanDumpUseSize] SetFileAttributes failed, %s, %d" (Indicator: "SetFileAttributes"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[PDHP::DoCopy] SetFileAttributes failed, %s, %u" (Indicator: "SetFileAttributes"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CopyWorkingProcess2Temp] SetFileAttributes failed, %s, %u" (Indicator: "SetFileAttributes"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "AntiStealthSetFileAttributes" (Indicator: "SetFileAttributes"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp")88:Tacc,Found reference to API "[CUtilAMPPL::CPAPP] UpdateProcThreadAttribute error (%d)" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[CUtilAMPPL::CPAPP] InitializeProcThreadAttributeList 2 error (%d)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[CUtilAMPPL::CPAPP] InitializeProcThreadAttributeList error (%d)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "[CUtilAMPPL::CPAPP] UpdateProcThreadAttribute error (%d)" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CUtilAMPPL::CPAPP] InitializeProcThreadAttributeList 2 error (%d)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "[CUtilAMPPL::CPAPP] InitializeProcThreadAttributeList error (%d)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")89:Tf6e,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "nsExec.dll") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "nsExec.dll") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "AddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SetSecurityDescriptorControl" (Indicator: "SetSecurityDescriptorControl"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "AddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp")8a:T860,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "astx_setup.exe") file/memory contains long string with (Indicator: "ExitProcess"; File: "nsExec.dll") file/memory contains long string with (Indicator: "TerminateProcess"; File: "nsExec.dll") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000772.00000000.203245.AD03C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001180.00000000.202120.008D3000.00000002.mdmp, 00000000-00001180.00000000.202120.72B42000.00000002.mdmp, 00000000-00001180.00000000.202120.72B64000.00000002.mdmp, 00000000-00001180.00000000.202120.72C89000.00000002.mdmp, 00000000-00001180.00000000.202120.72CB2000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001760.00000000.201943.0040F000.00000002.mdmp") Found reference to API "[CreateProcessTimeout] STILL_ACTIVE(TerminateProcess)" (Indicator: "TerminateProcess"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp") Found reference to API "[ScanParamProc] *** TerminateProcess *** (pid: %lu, file: %s, szAccessor: %s)" (Indicator: "TerminateProcess"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")8b:T52e,Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp")8c:T8d9,"V3Medic.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MKD2NADR") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MKD2NADR"; Key: "IMAGEPATH"; Value: "system32\drivers\Mkd2Nadr.sys") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CDM2DRNT"; Key: "USEDDLLS"; Value: "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ATAMPT.DLL") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AHNRGHNT"; Key: "PRODUCTFLAG"; Value: "1000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION"; Key: "DEPENDONSERVICE"; Value: "FltMgr") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION"; Key: "DESCRIPTION"; Value: "MeDCoreD_SafeTransaction mini-filter driver") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION"; Key: "GROUP"; Value: "FSFilter Security Enhancer") "ASDCli.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES"; Key: "DEFAULTINSTANCE"; Value: "MeDCoreD_SafeTransaction Instance") "ASDCli.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES\MEDCORED_SAFETRANSACTION INSTANCE") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES\MEDCORED_SAFETRANSACTION INSTANCE"; Key: "ALTITUDE"; Value: "381900.32412") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES\MEDCORED_SAFETRANSACTION INSTANCE"; Key: "FLAGS"; Value: "0000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AHNRGHNT"; Key: "PRODUCTFLAG"; Value: "3000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AMONCDW8"; Key: "PRODUCT"; Value: "0000080000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION"; Key: "DEPENDONSERVICE"; Value: "FltMgr")8d:T3b79,"!This program cannot be run in DOS mode.RichU.text`.rdata@.data.rsrc@.relocY_^[Y_^[u#SPuHSWt5SWY_^[u"h\Y_^[SVW3Genu5ineI5ntelt#=`_^[3tKWht6SWSVW3_^[YtUWhL$$=L$$3L$T3PhHTD$(FD$PBt$D3F,_^9~SV_^][_^][_^][tNPWVt PVSUVWt$ Vt$ V\$ 9D$D\$ vu3t$DSt$DWl$8Vupj:D$ hC VP_^][t$0V][_^t$ Wt$ Vt$@Wt$DV][_^][_^][_^t$ Wt$ Vt$@Wt$DV][_^][_^t$(Wt$0P]_^[t$0P]_^[t$HPt$ jt$\Uu&h`t$0P]_^[]_^[t$0P]_^[t$0P]_^[VjPW\$(Su.9FPSh$[_]^tLS3tDV3D$PS\$dU\$$hA4hXf/WhPD$(PD$$P_^][L$P3_^][3w1WSU]_^[+|$,WS;~]_^[]_^[\$(SD$ P][_^[_^][_^][_^]][_^][_^F(9D$ SUVW|$43_^]3tV9oD$(PjD$,UPt~Uj9l$4tZL$(Qt$SPV_^][_^][Vj(WL$ WV9jTW(jPWSUVWhD$$jD_^][_^][_^][_^]3SVj(W]^[_D$$U][_^][_^][_^][_^t$$V][_^][_^t$,V][_^CtPU][_^][_^][_^][_^][_^l$$3L$(QPD$$Pw(_^][_^][l$ C;^_]3^_][Yl$,Vt$(W3|$8WUPt$8PPPt$,PW|$,3_^][QQQQjHSUV3\$43D$HPQUt$xVD$HPD$\jt$pjt$@V9t$hutEh/l$ 3D$$PRQt$8PSQPWt$$SVPU\$,tD$,_^][t$$39\$,t$4jt$8W;D$,$Ph t$ PD$,PW_^][_^][D$(WPU_^][_^][RQPVF$9D$@SUVt$PWVD$8PD$ 0"1*1]1g1u1353w34$4*464<44W5w56'6-63696?6E6K6`6u6|6777J7868@8Y8b8g8z88 9%9<9F9O9::E:O:X:a:v:;0;9;D;K;^;l;r;x;~;<'<7<@8?3G3W3d3m3}37<7@78(9,989<9@9D9H9L99?1D1H1L1P1T1o1t1z12 2$2(22\3a3g3m3s3y37 7$7(7,707_79 9$9(9;x;|;6=6x6|69 9$9(9,9094989<9(:8 8$8(8R9Y92\2d2j2o23U3]3c3h33<4D4J4O4k4q4455=5C5H5d5j56+616`6p6x6~67&7-7F7U7i78B8G8Q8W8]8h8m8r89 9+949?9I9P9c9h9p9u9]1d1t8{8:?;K;|;8P>W>l?p?t?x?|?4D6r#>*>w>~>$>(>,>0>?6?L?='=4=8=<=@=D=H=i==?>u>6$7(7,707478796::<0$0*00060<0B0H0N0T0Z0`0f0l0r0x0~01 1&1,12181>1D1J1P1V1\1b1h1n1t1z12"2(2.242:2@2F2L2R2X2^2d2j2p2v2|23$3*30363<3B3H3N3T3Z3`3f3l3r3x3~34 4&4,42484>4D4J4P4V4\4b4h4n4t4z44P4p4707p7808@8p89 9@9P99 :0:@:;P;`;p;< H>`>1`1p11 2`2203p34 404@4P4`4p45 6`6p67`7p78 888<8@8D8H8L8X8h8p8t8x89 909@9`9:(:,:0:4:8:<:h:;P;`;p;;@ >d>p>2$2<2@2\2`200<0H0X0" (Indicator: "----begin certificate----") in Source: smime3.dll "-----BEGIN CERTIFICATE-----" (Indicator: "----begin certificate----") in Source: 39117-69-008CB2E0 "-----BEGIN CERTIFICATE-----" (Indicator: "----begin certificate----") in Source: 00000000-00001180.00000000.202120.008D3000.00000002.mdmp8e:Tcf5,"astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "astx_setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\ASFEA63.TMP\V3MEDIC.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CACLS.EXE"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "RECVBUFFERSIZE"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "DISABLETLS1.3"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "V3Medic.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")8f:T6a33,"V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MKD2NADR"; Key: "IMAGEPATH"; Value: "system32\drivers\Mkd2Nadr.sys") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\LIBAKCM.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\HSBDRV64.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\MKD2BTHF.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\MKD2NADR.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\MKD3KFNT.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\V3ELAMDR.CAT"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\V3ELAMDR.INF"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\V3ELAMDR.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\AMONLWLH.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\AHNRGHNT.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\AMONCDW7.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\AMONCDW8.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\AMONHKNT.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\AMONTDLH.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\AMONTDNT.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHAREDDLLS"; Key: "C:\WINDOWS\SYSTEM32\DRIVERS\CDM2DRNT.SYS"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION"; Key: "INSTALLPATH"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION"; Key: "PRODUCTNAME"; Value: "AhnLab Safe Transaction") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION"; Key: "PRODUCTSHORTNAME"; Value: "SafeTransaction") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION"; Key: "VERSION"; Value: "1.0") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\ASDF\SAFETRANSACTION"; Key: "DEBUGLOGPATH"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction\log") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\ASDF\SAFETRANSACTION"; Key: "ERRLOG"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION"; Key: "FIRSTBUILDNUMBER"; Value: "1.16.0.1978") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION"; Key: "STATE"; Value: "3200000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\AHNINST\218"; Key: "00040000"; Value: "Q9�") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\AHNINST"; Key: "218"; Value: "D810A78AA5C3D4AAC4B951687B167C6B6F29B111BF66492F7E07F8E5F8520D7BC3752FE20A2086E728B80B297E3D0536287B1AD1E0E3D4B8AACD632B8A80F9AD4B9F8F9A950498BF0D84A73F3D3190CDA4238A258EC44C00CBF368D3CE8167CE137803849B2609B90A7B620BC0C6D397F4096E31186E7648B5631C7C00858D6F456447FF7F55801621923D9E1419A90F7DB1D289447138BAA9A65874953E2DAB77331F247C63A1D7EAF67FD2E868E9EB117B214ED8F96E724695FCC01C8254194C0293AC5722A02153D20FD2461B4E143C9B003D1CE336919CC27A92958DFE1EBC61BF170EDC450838397015B74D0A8FB9650E47D2CAAE859C452475C74E71A38EEE97C0168ACEEB2F337CF9376C89FE8FF7A3397A267CE57F6483A73A77D76567A8FE43CEAF1E67B93A8CAAC96390DE8D8274FBB04C604C11C48A1DDC5EBE3E5804E2383BEC183C8C2D434A7A0B93320881A99C73DAB60D83D504CA49C478E57BBCB95651FE32D871A4611C4134CBB8ACFD09286466DA31C55D9CA71E69776A03BD720AECBB39068195921410D06135D11FA5A20A5BC5C57F31D304CDC7C2770FF7F03CA208F4AA50AE39821369F3285C6630480AB9D349D37B6E4971C3675E3C757654796BE255CE4E6430B6DD8CA70720C0E19912CEF811DAB45852967CCA3959240038A3CADD0F9189E938FE33CBFB79A444FE1A163F5F6DE742CC37949D00") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\AHNLAB\AHNINST"; Key: "218"; Value: "D810A78AA5C3D4AAC4B951687B167C6B6F29B111BF66492F7E07F8E5F8520D7BC3752FE20A2086E728B80B297E3D0536287B1AD1E0E3D4B8AACD632B8A80F9AD4B9F8F9A950498BF0D84A73F3D3190CDA4238A258EC44C00CBF368D3CE8167CE137803849B2609B90A7B620BC0C6D397F4096E31186E7648B5631C7C00858D6F456447FF7F55801621923D9E1419A90F7DB1D289447138BAA9A65874953E2DAB77331F247C63A1D7EAF67FD2E868E9EB117B214ED8F96E724695FCC01C8254194C0293AC5722A02153D20FD2461B4E143C9B003D1CE336919CC27A92958DFE1EBC61BF170EDC450838397015B74D0A8FB9650E47D2CAAE859C452475C74E71A38EEE97C0168ACEEB2F337CF9376C89FE8FF7A3397A267CE57F6483A73A77D76567A8FE43CEAF1E67B93A8CAAC96390DE8D8274FBB04C604C11C48A1DDC5EBE3E5804E2383BEC183C8C2D434A7A0B93320881A99C73DAB60D83D504CA49C478E57BBCB95651FE32D871A4611C4134CBB8ACFD09286466DA31C55D9CA71E69776A03BD720AECBB39068195921410D06135D11FA5A20A5BC5C57F31D304CDC7C2770FF7F03CA208F4AA50AE39821369F3285C6630480AB9D349D37B6E4971C3675E3C757654796BE255CE4E6430B6DD8CA70720C0E19912CEF811DAB45852967CCA3959240038A3CADD0F9189E938FE33CBFB79A444FE1A163F5F6DE742CC37949D00") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "DISPLAYNAME"; Value: "AhnLab Safe Transaction") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "INSTALLLOCATION"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "PUBLISHER"; Value: "AhnLab, Inc.") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "INSTALLSOURCE"; Value: "%TEMP%\asfEA63.tmp") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "REGOWNER"; Value: "AhnLab Safe Transaction") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "REGCOMPANY"; Value: "AhnLab, Inc.") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "DISPLAYICON"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction\StSess.exe") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "DISPLAYVERSION"; Value: "1.16.0.1978") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "NOMODIFY"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "NOREPAIR"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "INSTALLDATE"; Value: "20260107") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "UNINSTALLSTRING"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction\V3Medic.exe -Uninstall") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "VERSIONMAJOR"; Value: "0100000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "VERSIONMINOR"; Value: "1000000000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DD1D8D-927F-45DF-ADF4-75D38267848D}"; Key: "ESTIMATEDSIZE"; Value: "3C38030000") "V3Medic.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION"; Key: "STARTMENUFOLDER"; Value: "AhnLab\AhnLab Safe Transaction") "SysX64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\STCTINST"; Key: "INSTALLCACERT"; Value: "DB935E6900") "SysX64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\STCTINST"; Key: "NETSHFIREWALL"; Value: "EC935E6900") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CDM2DRNT"; Key: "USEDDLLS"; Value: "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ATAMPT.DLL") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AHNRGHNT"; Key: "PRODUCTFLAG"; Value: "1000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION"; Key: "DEPENDONSERVICE"; Value: "FltMgr") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION"; Key: "DESCRIPTION"; Value: "MeDCoreD_SafeTransaction mini-filter driver") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION"; Key: "GROUP"; Value: "FSFilter Security Enhancer") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES"; Key: "DEFAULTINSTANCE"; Value: "MeDCoreD_SafeTransaction Instance") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES\MEDCORED_SAFETRANSACTION INSTANCE"; Key: "ALTITUDE"; Value: "381900.32412") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDCORED_SAFETRANSACTION\INSTANCES\MEDCORED_SAFETRANSACTION INSTANCE"; Key: "FLAGS"; Value: "0000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\AVMON"; Key: "ELAMREGUSE"; Value: "0000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AHNRGHNT"; Key: "PRODUCTFLAG"; Value: "3000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AMONCDW8"; Key: "PRODUCT"; Value: "0000080000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION"; Key: "DEPENDONSERVICE"; Value: "FltMgr") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION"; Key: "DESCRIPTION"; Value: "MeDVpDrv_SafeTransaction mini-filter driver") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION"; Key: "GROUP"; Value: "FSFilter Security Enhancer") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION"; Key: "SUPPORTEDFEATURES"; Value: "0800000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION\INSTANCES"; Key: "DEFAULTINSTANCE"; Value: "MeDVpDrv_SafeTransaction Instance") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION\INSTANCES\MEDVPDRV_SAFETRANSACTION INSTANCE"; Key: "ALTITUDE"; Value: "381900.43105") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MEDVPDRV_SAFETRANSACTION\INSTANCES\MEDVPDRV_SAFETRANSACTION INSTANCE"; Key: "FLAGS"; Value: "0000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AMONCDW8"; Key: "PRODUCT"; Value: "0000080200") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TNFWNT_SAFETRANSACTION"; Key: "PRODUCT"; Value: "0000000200") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TNFWNT_SAFETRANSACTION"; Key: "FUNCFLAGS"; Value: "0100000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AMONCDW8"; Key: "PRODUCT"; Value: "0000080600") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TNNIPSNT_SAFETRANSACTION"; Key: "PRODUCT"; Value: "0000000400") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "TRAYRUNDEFERRED"; Value: "0000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "AHNLAB SAFE TRANSACTION APPLICATION"; Value: ""%PROGRAMFILES%\AhnLab\Safe Transaction\stsess.exe" /tray") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "NTFSDISABLELASTACCESSUPDATE"; Value: "0100008000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\PARAMETER"; Key: "REBOOT4SMARTSCAN"; Value: "0100000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "SKIPRPCP"; Value: "0000000000") "ASDCli.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "W10AMPPL"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\2BCD123D"; Key: "APPFULLPATH"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction\ASDSvc.exe") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\2BCD123D"; Key: "PERMITTEDLSPCATEGORIES"; Value: "0000008000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\07606421"; Key: "APPFULLPATH"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction\MUpdate2\ASDTEMP\ASDUp.exe") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\07606421"; Key: "PERMITTEDLSPCATEGORIES"; Value: "0000008000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\1B84F968"; Key: "APPFULLPATH"; Value: "%PROGRAMFILES%\AhnLab\Safe Transaction\ASDCli.exe") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\1B84F968"; Key: "PERMITTEDLSPCATEGORIES"; Value: "0000008000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "ALLOWREGKEY"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "EDRUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "HTTPSENGINEUSE25H1"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "PROXYUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\ASD"; Key: "INST2"; Value: "OnyXQu8WIOJkyymq0GZXkmRtZfs1iG0Aeu9rElcskW8=") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "CLOSEDNETWORKUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\LOW"; Key: "USER"; Value: "6400000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\LOW"; Key: "DAY"; Value: "0A00000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\LOW"; Key: "SUSPICIOUSSCORE"; Value: "1900000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\NORMAL"; Key: "USER"; Value: "F401000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\NORMAL"; Key: "DAY"; Value: "1400000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\NORMAL"; Key: "SUSPICIOUSSCORE"; Value: "0A00000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\HIGH"; Key: "USER"; Value: "2003000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\HIGH"; Key: "DAY"; Value: "1E00000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\REPUMON\HIGH"; Key: "SUSPICIOUSSCORE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB"; Key: "ASDPCID2"; Value: "fHliaGNmYmFuZm5uYmxqbWdtWA==") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\AVMON"; Key: "PUPSCANUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\AVMON"; Key: "REPUTATIONSCAN"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SCANCV"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\AVMON"; Key: "APPCARESCANUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "MEDSCAN"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SMARTSCANUSE"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "MEDLEVEL"; Value: "0200000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "JOINASDNETWORK"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "ASDEXTENDUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ANTISTEALTH_SAFETRANSACTIONF"; Key: "DEPENDONSERVICE"; Value: "FltMgr") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ANTISTEALTH_SAFETRANSACTIONF"; Key: "DESCRIPTION"; Value: "AntiStealth_SafeTransactionF mini-filter driver") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ANTISTEALTH_SAFETRANSACTIONF"; Key: "GROUP"; Value: "FSFilter Anti-Virus") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ANTISTEALTH_SAFETRANSACTIONF\INSTANCES"; Key: "DEFAULTINSTANCE"; Value: "AntiStealth_SafeTransactionF Instance") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ANTISTEALTH_SAFETRANSACTIONF\INSTANCES\ANTISTEALTH_SAFETRANSACTIONF INSTANCE"; Key: "ALTITUDE"; Value: "325940.79156") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ANTISTEALTH_SAFETRANSACTIONF\INSTANCES\ANTISTEALTH_SAFETRANSACTIONF INSTANCE"; Key: "FLAGS"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ANTISTEALTH_SAFETRANSACTIONF"; Key: "SUPPORTEDFEATURES"; Value: "0800000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "AUTOUPDATEPERIOD"; Value: "0300000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "SCHEDULEUPDATEUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "DISABLEFULLSCREEN"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SILENTMODE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\AHNRGHNT"; Key: "PRODUCTFLAG"; Value: "3000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CDM2DRNT"; Key: "REFDLLS"; Value: "%PROGRAMFILES%\AHNLAB\SAFE TRANSACTION\ATAMPT.DLL") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION"; Key: "DEPENDONSERVICE"; Value: "FltMgr") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION"; Key: "DESCRIPTION"; Value: "ATamptNt_SafeTransaction mini-filter driver") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION"; Key: "GROUP"; Value: "FSFilter Anti-Virus") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\INSTANCES"; Key: "DEFAULTINSTANCE"; Value: "ATamptNt_SafeTransaction Instance") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\INSTANCES\ATAMPTNT_SAFETRANSACTION INSTANCE"; Key: "ALTITUDE"; Value: "326030.23115") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\INSTANCES\ATAMPTNT_SAFETRANSACTION INSTANCE"; Key: "FLAGS"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION"; Key: "SUPPORTEDFEATURES"; Value: "0800000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION"; Key: "INTERNALOFFSET"; Value: "0000C02002F8FFFFE58CF1AF60050000640400005804000018050000B072450000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\PARAMETERS"; Key: "%1"; Value: "\Device\HarddiskVolume3\Program Files\AhnLab\Safe Transaction") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\PARAMETERS"; Key: "%2"; Value: "\Device\HarddiskVolume3\WINDOWS\system32") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\PARAMETERS"; Key: "%3"; Value: "\Device\HarddiskVolume3\WINDOWS") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\PARAMETERS"; Key: "%7"; Value: "\Device\HarddiskVolume3\Program Files\AhnLab") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ATAMPTNT_SAFETRANSACTION\PARAMETERS"; Key: "%8"; Value: "\Device\HarddiskVolume3\ProgramData\AhnLab") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDSELF"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDBOOTTIME"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDTARGETFILE"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDTARGETREGISTRY"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDTARGETPROCESS"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDTARGETDISKVOLUME"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDSELFRESTART"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDUSERFOLDERSELFRESTART"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDUSERFOLDER"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDUSERFOLDERHIDE"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDUSERFOLDERBOOTTIME"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SHIELDUIPROTECT"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SELFPROTECTARUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SELFPROTECTCERTLIST"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SELFPROTECTCASPPUSE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "SELFPROTECTSAFEMODE"; Value: "0000000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "PARENTCHECKPASSED"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "DETECTIONLOGPERIOD"; Value: "3C00000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "EVENTLOGPERIOD"; Value: "3C00000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "QUARANTINELOGPERIOD"; Value: "3C00000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "PURGEDUMPDAYS"; Value: "0300000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\COMMON"; Key: "LOGSPACECHECK"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SAFETRANSACTIONSVC"; Key: "START"; Value: "0200000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "AUTOUPDATEUSE"; Value: "0100000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "AUTOUPDATESTARTTIME"; Value: "0500000000") "ASDSvc.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\AHNLAB\SAFE TRANSACTION\OPTION\UPDATE"; Key: "AUTOUPDATEENDTIME"; Value: "2300000000")90:T882,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00001180.00000000.202120.72C89000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001760.00000000.201943.5A84B000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp") Found reference to API "[CNetworkStatusList::Load] hMutex Abandoned, ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp") Found reference to API "[CMemoryDMZ::Init] CreateMutex (Ret:%u)" (Indicator: "CreateMutex"; Source: "00000000-00002180.00000000.206903.58A31000.00000002.mdmp")91:T1004,"Core.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Core.dll]- [targetUID: 00000000-00003768] "Fw.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Fw.dll]- [targetUID: 00000000-00003768] "ASDi.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDi.dll]- [targetUID: 00000000-00003768] "StSess.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSess.exe]- [targetUID: 00000000-00005140] "ASDUp.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDUp.exe]- [targetUID: 00000000-00005140] "ASDCli.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDCli.exe]- [targetUID: 00000000-00005140] "AupASD.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AupASD.exe]- [targetUID: 00000000-00005140] "StSdk.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk.dll]- [targetUID: 00000000-00006240] "ASDSvc.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDSvc.exe]- [targetUID: 00000000-00005140] "ASDCr.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDCr.exe]- [targetUID: 00000000-00005140] "NzBrcom.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom.dll]- [targetUID: 00000000-00006240] "Mdp.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mdp.dll]- [targetUID: 00000000-00003768] "SCTX.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\SCTX.exe]- [targetUID: 00000000-00005140] "StSvr.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSvr.dll]- [targetUID: 00000000-00005140] "NzPlugin.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzPlugin.dll]- [targetUID: 00000000-00003768] "libcrypto-1_1-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libcrypto-1_1-x64.dll]- [targetUID: 00000000-00005140] "StCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtl.dll]- [targetUID: 00000000-00006240] "StCli.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCli.exe]- [targetUID: 00000000-00005140] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\ambassmt.dll]- [targetUID: 00000000-00005140] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ambassmt.dll]- [targetUID: 00000000-00005140] "TNNetUtil.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TNNetUtil.dll]- [targetUID: 00000000-00005140] "StSdk32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk32.dll]- [targetUID: 00000000-00006240] "Atampt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Atampt.dll]- [targetUID: 00000000-00003768] "NzBrcom32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom32.dll]- [targetUID: 00000000-00006240] "V3INet4.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet4.dll]- [targetUID: 00000000-00005140]92:T96d,Found string "VerQueryValueW" (Source: astx_setup.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoW" (Source: astx_setup.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoSizeW" (Source: astx_setup.exe, API is part of module: VERSION.DLL) Found string "SHGetFolderPathW" (Source: astx_setup.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "SHAutoComplete" (Source: astx_setup.exe, API is part of module: SHLWAPI.DLL) Found string "SHGetKnownFolderPath" (Source: astx_setup.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "InitiateShutdownW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyExW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "GetSystemDefaultLangID" (Source: astx_setup.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultUILanguage" (Source: astx_setup.exe, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExW" (Source: astx_setup.exe, API is part of module: KERNELBASE.DLL) Found string "SetDefaultDllDirectories" (Source: astx_setup.exe, API is part of module: KERNELBASE.DLL) Found string "RegDeleteKeyW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegCloseKey" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegEnumKeyW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegEnumValueW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegQueryValueExW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegSetValueExW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteValueW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "AdjustTokenPrivileges" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "LookupPrivilegeValueW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "OpenProcessToken" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "SetFileSecurityW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegOpenKeyExW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegCreateKeyExW" (Source: astx_setup.exe, API is part of module: ADVAPI32.DLL)93:T4d5,"ASDCli.exe" called "OpenServiceW" to access the "Cdm2DrNt" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights "ASDCli.exe" called "OpenServiceW" to access the "FltMgr" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights "ASDCli.exe" called "OpenServiceW" to access the "MeDCoreD_SafeTransaction" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "ASDCli.exe" called "OpenServiceW" to access the "AMonCDW8" service requesting "SERVICE_QUERY_CONFIG" (0X1) access rights "ASDCli.exe" called "OpenServiceW" to access the "AMonCDW8" service requesting "SERVICE_ALL_ACCESS" (0XF01FF) access rights "ASDCli.exe" called "OpenServiceW" to access the "SafeTransactionSVC" service requesting "SERVICE_QUERY_CONFIG" (0X1) access rights "ASDCli.exe" called "OpenServiceW" to access the "SafeTransactionSVC" service requesting "SERVICE_CHANGE_CONFIG" (0X2) access rights "ASDCli.exe" called "OpenServiceW" to access the "SafeTransactionSVC" service requesting "SERVICE_QUERY_STATUS" (0X4) access rights "ASDCli.exe" called "OpenServiceW" to access the "SafeTransactionSVC" service "ASDCli.exe" called "OpenServiceW" to access the "SafeTransactionSVC" service requesting "SERVICE_START" (0X10) access rights94:T5a79,"Core.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Core.dll]- [targetUID: 00000000-00003768] "Fw.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Fw.dll]- [targetUID: 00000000-00003768] "ASDi.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDi.dll]- [targetUID: 00000000-00003768] "StSess.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSess.exe]- [targetUID: 00000000-00005140] "ASDUp.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDUp.exe]- [targetUID: 00000000-00005140] "ASDCli.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDCli.exe]- [targetUID: 00000000-00005140] "AupASD.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AupASD.exe]- [targetUID: 00000000-00005140] "StSdk.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk.dll]- [targetUID: 00000000-00006240] "ASDSvc.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDSvc.exe]- [targetUID: 00000000-00005140] "ASDCr.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDCr.exe]- [targetUID: 00000000-00005140] "NzBrcom.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom.dll]- [targetUID: 00000000-00006240] "Mdp.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mdp.dll]- [targetUID: 00000000-00003768] "SCTX.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\SCTX.exe]- [targetUID: 00000000-00005140] "StSvr.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSvr.dll]- [targetUID: 00000000-00005140] "NzPlugin.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzPlugin.dll]- [targetUID: 00000000-00003768] "libcrypto-1_1-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libcrypto-1_1-x64.dll]- [targetUID: 00000000-00005140] "StCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtl.dll]- [targetUID: 00000000-00006240] "StCli.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCli.exe]- [targetUID: 00000000-00005140] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\ambassmt.dll]- [targetUID: 00000000-00005140] "ambassmt.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ambassmt.dll]- [targetUID: 00000000-00005140] "TNNetUtil.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TNNetUtil.dll]- [targetUID: 00000000-00005140] "StSdk32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSdk32.dll]- [targetUID: 00000000-00006240] "Atampt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Atampt.dll]- [targetUID: 00000000-00003768] "NzBrcom32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzBrcom32.dll]- [targetUID: 00000000-00006240] "V3INet4.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet4.dll]- [targetUID: 00000000-00005140] "medcore.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medcore.dll]- [targetUID: 00000000-00003768] "AtamptU.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AtamptU.dll]- [targetUID: 00000000-00005140] "atstrumt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\atstrumt.dll]- [targetUID: 00000000-00006240] "Ips.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Ips.dll]- [targetUID: 00000000-00003768] "StCtl32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtl32.dll]- [targetUID: 00000000-00006240] "AhnIEx.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\AhnIEx.dll]- [targetUID: 00000000-00005140] "V3INet3.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet3.dll]- [targetUID: 00000000-00005140] "sqlite3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\sqlite3.dll]- [targetUID: 00000000-00005140] "atstrust.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\atstrust.dll]- [targetUID: 00000000-00005140] "V3Medic.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\asfEA63.tmp\V3Medic.exe]- [targetUID: 00000000-00005140] "V3Medic.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3Medic.exe]- [targetUID: 00000000-00005140] "Av.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Av.dll]- [targetUID: 00000000-00003768] "ASDWsc.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ASDWsc.exe]- [targetUID: 00000000-00005140] "medvphku.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvphku.dll]- [targetUID: 00000000-00005140] "AhnIEx.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsuE86E.tmp\AhnIEx.dll]- [targetUID: 00000000-00005140] "Ark64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Ark64.dll]- [targetUID: 00000000-00005140] "medext.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medext.dll]- [targetUID: 00000000-00003768] "NzInst.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzInst.dll]- [targetUID: 00000000-00009068] "trueeyesu.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\nst3FC5.tmp\e\trueeyesu.dll]- [targetUID: 00000000-00005140] "UpEx.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\UpEx.dll]- [targetUID: 00000000-00005140] "HsbCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\HsbCtl.dll]- [targetUID: 00000000-00003768] "NzInst32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\NzInst32.dll]- [targetUID: 00000000-00005140] "medvphkuw6.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvphkuw6.dll]- [targetUID: 00000000-00005140] "PdCfg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\PdCfg.dll]- [targetUID: 00000000-00003768] "StSess32.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StSess32.exe]- [targetUID: 00000000-00005140] "StCtInst.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\StCtInst.dll]- [targetUID: 00000000-00005140] "powapi.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\powapi.dll]- [targetUID: 00000000-00005140] "HsbCtl32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\HsbCtl32.dll]- [targetUID: 00000000-00006240] "libssl-1_1-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libssl-1_1-x64.dll]- [targetUID: 00000000-00005140] "V3Cert.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3Cert.dll]- [targetUID: 00000000-00005140] "ahloha.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ahloha.dll]- [targetUID: 00000000-00005140] "Ark64lgplv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Ark64lgplv2.dll]- [targetUID: 00000000-00005140] "ScrMon32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ScrMon32.dll]- [targetUID: 00000000-00006240] "aostrust.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\aostrust.dll]- [targetUID: 00000000-00005140] "freebl3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\freebl3.dll]- [targetUID: 00000000-00005140] "powapi32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\powapi32.dll]- [targetUID: 00000000-00005140] "nss3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nss3.dll]- [targetUID: 00000000-00005140] "AI7z20.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\AI7z20.dll]- [targetUID: 00000000-00005140] "mkd25.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25.dll]- [targetUID: 00000000-00006240] "AhnUp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnUp.dll]- [targetUID: 00000000-00005140] "aostrust32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\aostrust32.dll]- [targetUID: 00000000-00005140] "nssckbi.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nssckbi.dll]- [targetUID: 00000000-00005140] "mkd25def64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25def64.dll]- [targetUID: 00000000-00006240] "mkd2564.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd2564.dll]- [targetUID: 00000000-00006240] "ssl3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ssl3.dll]- [targetUID: 00000000-00005140] "TSFltCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TSFltCtl.dll]- [targetUID: 00000000-00003768] "mkd25def.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25def.dll]- [targetUID: 00000000-00006240] "softokn3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\softokn3.dll]- [targetUID: 00000000-00005140] "libnspr4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libnspr4.dll]- [targetUID: 00000000-00005140] "RestoreU.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\nst3FC5.tmp\e\RestoreU.exe]- [targetUID: 00000000-00005140] "libacm.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libacm.dll]- [targetUID: 00000000-00006240] "asc_main.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\asc_main.dll]- [targetUID: 00000000-00005140] "MUpdate2.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%TEMP%\nst3FC5.tmp\e\MUpdate2.exe]- [targetUID: 00000000-00005140] "mkd25sdk.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25sdk.dll]- [targetUID: 00000000-00006240] "AhnI2t.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\AhnI2t.dll]- [targetUID: 00000000-00005140] "CdmAPI.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\CdmAPI.dll]- [targetUID: 00000000-00003768] "tnnipsct.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnnipsct.dll]- [targetUID: 00000000-00003768] "tnfwct.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnfwct.dll]- [targetUID: 00000000-00003768] "tnhipsct.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnhipsct.dll]- [targetUID: 00000000-00003768] "SysARM64.exe" has type "PE32+ executable for MS Windows 6.02 (console) ARM64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\SysARM64.exe]- [targetUID: 00000000-00005140] "AhnUpCtl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnUpCtl.dll]- [targetUID: 00000000-00005140] "V3Hunt.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3Hunt.dll]- [targetUID: 00000000-00005140] "certutil.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\certutil.exe]- [targetUID: 00000000-00005140] "nssutil3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nssutil3.dll]- [targetUID: 00000000-00005140] "tsPatcha.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tsPatcha.dll]- [targetUID: 00000000-00005140] "smime3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\smime3.dll]- [targetUID: 00000000-00005140] "nssdbm3.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\nssdbm3.dll]- [targetUID: 00000000-00005140] "AhnI2.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnI2.dll]- [targetUID: 00000000-00006240] "SysX64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\nst3FC5.tmp\SysX64.exe]- [targetUID: 00000000-00003768] "tsmime.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tsmime.dll]- [targetUID: 00000000-00005140] "vcruntime140.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\vcruntime140.dll]- [targetUID: 00000000-00005140] "mkd25sdk64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd25sdk64.dll]- [targetUID: 00000000-00006240] "CdmCtrl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\CdmCtrl.dll]- [targetUID: 00000000-00003768] "V3ElamCt.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3ElamCt.dll]- [targetUID: 00000000-00005140] "WinFWMgr.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\WinFWMgr.dll]- [targetUID: 00000000-00005140] "IAccessible2Proxy.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\IAccessible2Proxy.dll]- [targetUID: 00000000-00006240] "mspatcha.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mspatcha.dll]- [targetUID: 00000000-00005140] "V3INet2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3INet2.dll]- [targetUID: 00000000-00005140] "AhnCtlKd.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnCtlKd.dll]- [targetUID: 00000000-00003768] "IAccessible2Proxy32.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\IAccessible2Proxy32.dll]- [targetUID: 00000000-00006240] "BtScnCtl.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nst3FC5.tmp\e\BtScnCtl.dll]- [targetUID: 00000000-00005140] "libplc4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libplc4.dll]- [targetUID: 00000000-00005140] "InstallOptions.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\InstallOptions.dll]- [targetUID: 00000000-00005140] "libplds4.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libplds4.dll]- [targetUID: 00000000-00005140] "System.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsuE86E.tmp\System.dll]- [targetUID: 00000000-00005140] "nsExec.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsuE86E.tmp\nsExec.dll]- [targetUID: 00000000-00002504] "medcored.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medcored.sys]- [targetUID: 00000000-00005140] "medvpdrv.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvpdrv.sys]- [targetUID: 00000000-00005140] "AtamptNt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AtamptNt.sys]- [targetUID: 00000000-00005140] "TSFltDrv.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TSFltDrv.sys]- [targetUID: 00000000-00005140] "AMonCDW8.sys" has type "PE32+ executable for MS Windows 6.02 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonCDW8.sys]- [targetUID: 00000000-00005140] "AMonCDW7.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonCDW7.sys]- [targetUID: 00000000-00005140] "tnhipsnt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnhipsnt.sys]- [targetUID: 00000000-00005140] "mkd3kfnt.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\mkd3kfnt.sys]- [targetUID: 00000000-00005140] "tnfwnt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnfwnt.sys]- [targetUID: 00000000-00005140] "tnnipsnt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\tnnipsnt.sys]- [targetUID: 00000000-00005140] "libakcm.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\libakcm.sys]- [targetUID: 00000000-00005140] "TFFREGNT.SYS" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\TFFREGNT.SYS]- [targetUID: 00000000-00005140] "Mkd2Nadr.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mkd2Nadr.sys]- [targetUID: 00000000-00005140] "AHAWKE.DLL" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AHAWKE.DLL]- [targetUID: 00000000-00003768] "HsbDrv64.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\HsbDrv64.sys]- [targetUID: 00000000-00005140] "AKDVE.EXE" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AKDVE.EXE]- [targetUID: 00000000-00005140] "AMonTDNt.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonTDNt.sys]- [targetUID: 00000000-00005140] "AMonTDLH.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonTDLH.sys]- [targetUID: 00000000-00005140] "Mkd2bthf.sys" has type "PE32+ executable for MS Windows 6.01 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Mkd2bthf.sys]- [targetUID: 00000000-00005140] "Cdm2DrNt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\Cdm2DrNt.sys]- [targetUID: 00000000-00005140] "AMonHKNT.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonHKNT.sys]- [targetUID: 00000000-00005140] "AhnRghNt.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AhnRghNt.sys]- [targetUID: 00000000-00005140] "AHAWKENT.SYS" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AHAWKENT.SYS]- [targetUID: 00000000-00005140] "AMonLWLH.sys" has type "PE32+ executable for MS Windows 6.00 (native) x86-64 8 sections"- Location: [%TEMP%\nst3FC5.tmp\e\AMonLWLH.sys]- [targetUID: 00000000-00005140] "medvphkd.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\medvphkd.sys]- [targetUID: 00000000-00005140] "ALWFCtrl.Dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- Location: [%TEMP%\nst3FC5.tmp\e\ALWFCtrl.Dll]- [targetUID: 00000000-00005140] "V3ElamDr.sys" has type "PE32+ executable for MS Windows 6.02 (native) x86-64 7 sections"- Location: [%TEMP%\nst3FC5.tmp\e\V3ElamDr.sys]- [targetUID: 00000000-00005140]95:Taf4,"astx_setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp\AhnIEx.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "astx_setup.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "astx_setup.exe" wrote 6656 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp\nsExec.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "astx_setup.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\V3Medic.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "V3Medic.exe" wrote 65532 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\Fw.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "V3Medic.exe" wrote 14173 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\WinFwMgr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "V3Medic.exe" wrote 65532 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\Ips.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...96:T422,"V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1081f" "cx": "150" "cy": "57"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1081f" "cx": "16" "cy": "16"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1081f" "cx": "164" "cy": "314"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "20109b5" "cx": "75" "cy": "23"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "107b7" "cx": "75" "cy": "23"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "3101094e" "cx": "450" "cy": "18"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "54010a5f" "cx": "450" "cy": "18"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "b010a8e" "cx": "17" "cy": "175"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "b010a8e" "cx": "17" "cy": "141"} "V3Medic.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "10ab0" "cx": "17" "cy": "175"}97:T42f,"SysX64.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter System" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00007544) "SysX64.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00007544)98:Taf8,"SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "Everyone" "Sid": "0" "cbSid": "0c000000" "cchReferencedDomainName": "01000000" "peUse": "08000000"} "SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "Everyone" "Sid": "37067744" "cbSid": "0c000000" "cchReferencedDomainName": "00000000" "peUse": "05000000"} "SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "ALL APPLICATION PACKAGES" "Sid": "0" "cbSid": "10000000" "cchReferencedDomainName": "1e000000" "peUse": "08000000"} "SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "ALL APPLICATION PACKAGES" "Sid": "37067648" "cbSid": "10000000" "ReferencedDomainName": "APPLICATION PACKAGE AUTHORITY" "cchReferencedDomainName": "1d000000" "peUse": "05000000"} "SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "Everyone" "Sid": "41786816" "cbSid": "0c000000" "cchReferencedDomainName": "00000000" "peUse": "05000000"} "SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "ALL APPLICATION PACKAGES" "Sid": "41786208" "cbSid": "10000000" "ReferencedDomainName": "APPLICATION PACKAGE AUTHORITY" "cchReferencedDomainName": "1d000000" "peUse": "05000000"} "SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "Everyone" "Sid": "35822656" "cbSid": "0c000000" "cchReferencedDomainName": "00000000" "peUse": "05000000"} "SysX64.exe" called "LookupAccountNameW" with parameters {"AccountName": "ALL APPLICATION PACKAGES" "Sid": "35822752" "cbSid": "10000000" "ReferencedDomainName": "APPLICATION PACKAGE AUTHORITY" "cchReferencedDomainName": "1d000000" "peUse": "05000000"} "ASDCli.exe" called "LookupAccountNameW" with parameters {"AccountName": "everyone" "Sid": "0" "cbSid": "0c000000" "cchReferencedDomainName": "01000000" "peUse": "00000000"} "ASDCli.exe" called "LookupAccountNameW" with parameters {"AccountName": "everyone" "Sid": "18054752" "cbSid": "0c000000" "cchReferencedDomainName": "00000000" "peUse": "05000000"} "ASDCli.exe" called "LookupAccountNameW" with parameters {"AccountName": "everyone" "Sid": "18163744" "cbSid": "0c000000" "cchReferencedDomainName": "00000000" "peUse": "05000000"} "ASDCli.exe" called "LookupAccountNameW" with parameters {"AccountName": "everyone" "Sid": "18164128" "cbSid": "0c000000" "cchReferencedDomainName": "00000000" "peUse": "05000000"} "ASDSvc.exe" called "LookupAccountNameW" with parameters {"AccountName": "everyone" "Sid": "0" "cbSid": "0c000000" "cchReferencedDomainName": "01000000" "peUse": "00000000"} "ASDSvc.exe" called "LookupAccountNameW" with parameters {"AccountName": "everyone" "Sid": "5017376" "cbSid": "0c000000" "cchReferencedDomainName": "00000000" "peUse": "05000000"}99:T982,"astx_setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsdE687.tmp" with delete access "astx_setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuE86E.tmp" with delete access "astx_setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\product.dat.ahc" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\msvcp90.dll.ahc" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\msvcr90.dll.ahc" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\aos.sld" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\defcfg.db" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\ipcntry.db" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\nzcmncfg.db" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\nzdefcfg.db" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\extraopn_ply.ui" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\netizen_ply_default.ui" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\ply_ver.ui" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\starter_ply.ui" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\drvinfo_astx.ini" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\mupdate2.cfg" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\oss_notice.txt" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\Product.dat" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\tnnipprt.rul" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\tnnipsig.rul" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\V3Prtect.dat" with delete access "V3Medic.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst3FC5.tmp\e\astx.inf" with delete access9a:T9c2,"astx_setup.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\asfEA63.tmp\V3Medic.exe" (Handle: 848) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\cacls.exe" (Handle: 808) "SysX64.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\certutil.exe" (Handle: 632) "SysX64.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\certutil.exe" (Handle: 632) "SysX64.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe" (Handle: 708) "SysX64.exe" wrote 00000008 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe" (Handle: 708) "SysX64.exe" wrote 00000004 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\Cert\nss\certutil.exe" (Handle: 708) "SysX64.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\CheckNetIsolation.exe" (Handle: 708) "SysX64.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\CheckNetIsolation.exe" (Handle: 708) "SysX64.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 668) "SysX64.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 668) "SysX64.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\ASDCli.exe" (Handle: 548) "SysX64.exe" wrote 00000008 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\ASDCli.exe" (Handle: 548) "ASDSvc.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 1132) "ASDSvc.exe" wrote 00000008 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 1132) "ASDSvc.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 988) "ASDSvc.exe" wrote 00000008 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 988) "ASDSvc.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 1124) "ASDSvc.exe" wrote 00000008 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 1124) "ASDSvc.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 1140) "ASDSvc.exe" wrote 00000008 bytes to a remote process "C:\Program Files\AhnLab\Safe Transaction\AKDVE.EXE" (Handle: 1140)9b:T866,"certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\pkcs11.txt" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cert9.db-journal" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db-journal" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\pkcs11.txt" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cert9.db-journal" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db-journal" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\pkcs11.txt" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\pkcs11.txu" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\cert9.db" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\cert9.db-journal" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db" "certutil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db-journal" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\pkcs11.txt" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\pkcs11.txu" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\cert9.db" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\cert9.db-journal" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db" "certutil.exe" trying to open a file "%APPDATA%\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db-journal"9c:Te5e,Spawned process "astx_setup.exe" (UID: 00000000-00002504) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /C "ECHO Y| cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)"" (UID: 00000000-00004292) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" ECHO Y"" (UID: 00000000-00008048) Spawned process "cacls.exe" with commandline "cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)" (UID: 00000000-00004844) Spawned process "V3Medic.exe" (UID: 00000000-00005140) Spawned process "SysX64.exe" (UID: 00000000-00003560) Spawned process "SysX64.exe" (UID: 00000000-00009068) Spawned process "SysX64.exe" (UID: 00000000-00007544) Spawned process "SysX64.exe" (UID: 00000000-00001760) Spawned process "certutil.exe" with commandline "certutil -addstore -f root "%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der"" (UID: 00000000-00008584) Spawned process "certutil.exe" with commandline "certutil -repairstore root 9c786262fd7479bd "%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\astx.inf"" (UID: 00000000-00004516) Spawned process "certutil.exe" with commandline ""%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil" -A -n "ASTxRoot2" -d sql:"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release" -t "C " -i "%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der"" (UID: 00000000-00001180) Spawned process "certutil.exe" with commandline ""%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil" -A -n "ASTxRoot2" -d "%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default" -t "C " -i "%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der"" (UID: 00000000-00008084) Spawned process "CheckNetIsolation.exe" with commandline "LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe" (UID: 00000000-00001448) Spawned process "SysX64.exe" (UID: 00000000-00006588) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall set rule name="AhnLab Safe Transaction" dir=in new action=allow program="%PROGRAMFILES%\\AhnLab\\Safe Transaction\\StSess.exe" enable=yes" (UID: 00000000-00005148) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall delete rule name="AhnLab Safe Transaction" dir=in" (UID: 00000000-00000772) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="AhnLab Safe Transaction" dir=in action=allow program="%PROGRAMFILES%\\AhnLab\\Safe Transaction\\StSess.exe" enable=yes" (UID: 00000000-00007924) Spawned process "SysX64.exe" (UID: 00000000-00003492) Spawned process "ASDCli.exe" with commandline "/register" (UID: 00000000-00003768) Spawned process "SysX64.exe" (UID: 00000000-00001348) Spawned process "SysX64.exe" (UID: 00000000-00000976) Spawned process "SysX64.exe" (UID: 00000000-00008700) Spawned process "SysX64.exe" (UID: 00000000-00003664) Spawned process "SysX64.exe" (UID: 00000000-00003968) Spawned process "SysX64.exe" (UID: 00000000-00006240) Spawned process "SysX64.exe" (UID: 00000000-00008168) Spawned process "ASDCli.exe" with commandline "/start" (UID: 00000000-00005236) Spawned process "ASDSvc.exe" (UID: 00000000-00002180) Spawned process "AKDVE.exe" with commandline "1111111011010000000000000000000_AntiStealth_SafeTransactionF" (UID: 00000000-00006296) Spawned process "AKDVE.exe" with commandline "1111111100000000000000000000000_AntiStealth_SafeTransactionF" (UID: 00000000-00004088) Spawned process "AKDVE.exe" with commandline "1111111100000000000000000000000_AntiStealth_SafeTransactionF" (UID: 00000000-00002508) Spawned process "AKDVE.exe" with commandline "1111111100100000000000000000000_AntiStealth_SafeTransactionF" (UID: 00000000-00007488)9d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAd3hwAAAAAAAAAAAAAAB3d4iIdwAAAAAAAAAAAAd3iIiIiHdwAAAAAAAAAAB3iIiIiIh3dwAAAAAAAAB3d4iIiIiId3dwAAAAAAAHiHeIiIiIiHd3dwAAAAAAeIh3iIiIiIh3d3dwAAAAB4iId4iIiIiId3d3cAAAAHiIiHeIiIiIiHd3d3AAAACIiIh3iIiIiIh3d3dwAAAIiIiId4iIiIhzN3d3dwAACIiIiHeIiId3MzOIiHcAAIiIiIh3iHdzdzMzeIiHAACP+Ih3eHd3c3czs3eIiHAAj/+Hd4iId3N3M7N3eIiHAI//h4iIiIdzdzOzc3d3iHCP//eIiIiIc3M7s3M3iHd3j///eIc4iIczO7d3iP9wd4///4dzM3iDk7u4iIiPcACP///3O4uTmTiLeIiIiHAAiP//87u4s7iIi4iIiIcAAAj///O7u4iP+IiIiIiHAAAI///4i7u4iIeIiIiIhwAAAI/////4i7s3iIiIiHAAAACP//////+It4iIiIhwAAAACP////////iIiIiHAAAAAACP////////iIiIcAAAAAAACP////////iIhwAAAAAAAACI////////iHAAAAAAAAAAAIiP////iIAAAAAAAAAAAAAAiIiIiIAAAAAAAAD//+////8H///wA///gAH//wAA//wAAH/4AAA/8AAAH+AAAB/AAAAfwAAAH4AAAA+AAAAPAAAADwAAAAcAAAADAAAAAQAAAAAAAAAEAAAABwAAAAcAAAAPgAAAD4AAAA/AAAAfwAAAH+AAAD/wAAB/+AAA//wAAf//AAf//8Af/w==9e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAABwAAAAAAAAAAAAAAAAAAd3hwAAAAAAAAAAAAAAB3d4iIdwAAAAAAAAAAAAd3iIiIiHdwAAAAAAAAAAB3iIiIiIh3dwAAAAAAAAB3d4iIiIiId3dwAAAAAAAHiHeIiIiIiHd3dwAAAAAAeIh3iIiIiIh3d3dwAAAAB4iId4iIiIiId3d3cAAAAHiIiHeIiIiIiHd3d3AAAACIiIh3iIiIiIh3d3dwAAAIiIiId4iIiIhzN3d3dwAACIiIiHeIiId3MzOIiHcAAIiIiIh3iHdzdzMzeIiHAACP+Ih3eHd3c3czs3eIiHAAj/+Hd4iId3N3M7N3eIiHAI//h4iIiIdzdzOzc3d3iHCP//eIiIiIc3M7s3M3iHd3j///eIc4iIczO7d3iP9wd4///4dzM3iDk7u4iIiPcACP///3O4uTmTiLeIiIiHAAiP//87u4s7iIi4iIiIcAAAj///O7u4iP+IiIiIiHAAAI///4i7u4iIeIiIiIhwAAAI/////4i7s3iIiIiHAAAACP//////+It4iIiIhwAAAACP////////iIiIiHAAAAAACP////////iIiIcAAAAAAACP////////iIhwAAAAAAAACI////////iHAAAAAAAAAAAIiP////iIAAAAAAAAAAAAAAiIiIiIAAAAAAAAD//+////8H///wA///gAH//wAA//wAAH/4AAA/8AAAH+AAAB/AAAAfwAAAH4AAAA+AAAAPAAAADwAAAAcAAAADAAAAAQAAAAAAAAAEAAAABwAAAAcAAAAPgAAAD4AAAA/AAAAfwAAAH+AAAD/wAAB/+AAA//wAAf//AAf//8Af/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790907230970,"unified_at":"2026-10-02T02:13:50.970Z","metadata":{"hashes":{"sha256":"144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a","sha1":"3e019112dc00c4a1f14474ea6db68f35674a6efa","md5":"97b4c2e67e5e18b70949690a69820c2a","sha512":"d8df59a49feafa21dfea8eeccdef64a9a40312668d26c28b394440bbd5228d5a2e55f5aee35e3a618aa6f06e3e42e2d11e308abcca464ebd05c6851128054d73","ssdeep":"3145728:SVAgMHibxAx1vEhv663ebGqdYM75rEMNvi9vr5I7Z:MAXC9upT6OqqdYiEOvipq9","ssdeep_chunks":["3145728:SVAgMHi","3145728:VAgMHib","3145728:AgMHibx","3145728:gMHibxA","3145728:MHibxAx","3145728:HibxAx1","3145728:ibxAx1v","3145728:bxAx1vE","3145728:xAx1vEh","3145728:Ax1vEhv","3145728:x1vEhv6","3145728:1vEhv66","3145728:vEhv663","3145728:Ehv663e","3145728:hv663eb","3145728:v663ebG","3145728:663ebGq","3145728:63ebGqd","3145728:3ebGqdY","3145728:ebGqdYM","3145728:bGqdYM7","3145728:GqdYM75","3145728:qdYM75r","3145728:dYM75rE","3145728:YM75rEM","3145728:M75rEMN","3145728:75rEMNv","3145728:5rEMNvi","3145728:rEMNvi9","3145728:EMNvi9v","3145728:MNvi9vr","3145728:Nvi9vr5","3145728:vi9vr5I","3145728:i9vr5I7","3145728:9vr5I7Z","6291456:SVAgMHi","6291456:VAgMHib","6291456:AgMHibx","6291456:gMHibxA","6291456:MHibxAx","6291456:HibxAx1","6291456:ibxAx1v","6291456:bxAx1vE","6291456:xAx1vEh","6291456:Ax1vEhv","6291456:x1vEhv6","6291456:1vEhv66","6291456:vEhv663","6291456:Ehv663e","6291456:hv663eb","6291456:v663ebG","6291456:663ebGq","6291456:63ebGqd","6291456:3ebGqdY","6291456:ebGqdYM","6291456:bGqdYM7","6291456:GqdYM75","6291456:qdYM75r","6291456:dYM75rE","6291456:YM75rEM","6291456:M75rEMN","6291456:75rEMNv","6291456:5rEMNvi","6291456:rEMNvi9","6291456:EMNvi9v","6291456:MNvi9vr","6291456:Nvi9vr5","6291456:vi9vr5I","6291456:i9vr5I7","6291456:9vr5I7Z","3145728:MAXC9up","3145728:AXC9upT","3145728:XC9upT6","3145728:C9upT6O","3145728:9upT6Oq","3145728:upT6Oqq","3145728:pT6Oqqd","3145728:T6OqqdY","3145728:6OqqdYi","3145728:OqqdYiE","3145728:qqdYiEO","3145728:qdYiEOv","3145728:dYiEOvi","3145728:YiEOvip","3145728:iEOvipq","3145728:EOvipq9"],"imphash":"Unknown"},"file_info":{"file_name":"astx_setup.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":103097736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1767776968000,"last_seen":1767776968000,"last_multi_scan":1767776968000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":106},"sandbox_signatures":{"informative_count":255,"suspicious_count":23,"malicious_count":12,"total":290},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Executes echo command"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Able to access kernel callback routine (string)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"},{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Uses certutil from the Windows Certificate Services"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"},{"type":"informative","value":"Modifies file/folder permission using cacls"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Install Root Certificate","attack_id":"T1553.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/004","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Tries to steal Firefox browser credentials"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to retrieve internet cache entries (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"},{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"malicious","value":"Requested access to a critical system service"},{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"malicious","value":"Able to use RSA keys for encryption and decryption"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a webserver"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access kernel callback routine (string)","description":"file/memory contains long string with (Indicator: \"psremovecreatethreadnotifyroutine\"; File: \"AhnRghNt.sys\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-978","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"SysX64.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00009068)\n \"SysX64.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00007544)\n \"SysX64.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00001760)\n \"SysX64.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00006588)\n \"netsh.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00005148)\n \"netsh.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00000772)\n \"netsh.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00007924)\n \"SysX64.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00003492)\n \"ASDCli.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"V3Medic.exe\" called \"LoadResource with parameter {'hModule': '268435456', 'hResInfo': '271058984'}\" (UID: 00000000-00005140)\n \"V3Medic.exe\" called \"LoadResource with parameter {'hModule': '268435456', 'hResInfo': '271059112'}\" (UID: 00000000-00005140)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"astx_setup.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")\n Found reference to API \"[CQuarantineItemReg::SaveValue] RegSetValueEx(%s) failed(%u)\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"astx_setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"astx_setup.exe\")\n Found reference to API \"[_SetFileTime] CreateFileW failed(%d), %s\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"[_SetFileTime] SetFileTime failed(%d), %s\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002180.00000000.206903.59099000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008168.00000000.206624.59099000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies file/folder permission using cacls","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /C \"ECHO Y| cacls %TEMP%\\\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)\"\" (UID: 00000000-00004292)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":3,"id":"target-349","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$30","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"astx_setup.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001180-39117-11-008D1B01\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001180-39117-128-008D2062\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001180-39117-277-008D21B7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$31","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"[CScannerContext::CureMalware] DS_DecryptFile (%d)\" (Indicator: \"DecryptFile\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"[CScanDRMManager::DS_DecryptFile] _SendMsg() return(%u) dwResult(%u) - <%s>\" (Indicator: \"DecryptFile\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"DS_DecryptFile\" (Indicator: \"DecryptFile\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$35","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"Found string \"[ISecuredDBImpl::Backup] CreateDirectory(%s)(%u)\" (Indicator: \"createdirectory(\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"ZwQuerySystemInformation\"; File: \"Mkd2Nadr.sys\")\n file/memory contains long string with (Indicator: \"ZwQuerySystemInformation\"; File: \"HsbDrv64.sys\")\n file/memory contains long string with (Indicator: \"ZwQuerySystemInformation\"; File: \"AKDVE.EXE\")\n file/memory contains long string with (Indicator: \"ZwQuerySystemInformation\"; File: \"AMonHKNT.sys\")\n file/memory contains long string with (Indicator: \"ZwQuerySystemInformation\"; File: \"AHAWKENT.SYS\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005148-00000C2C-2165547410\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VMwareUser\" (Indicator: \"vmwareuser\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005148-00000C2C-2165547410\")\n Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00002180-00000C2C-2232625028\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\%s\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"$37","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \"[ISecuredDBImpl::Backup] CreateDirectory(%s)(%u)\" (Indicator: \"createdirectory(\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001760.00000000.201943.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"libnspr4.dll\")\n Found reference to API \"GetAddrInfoExCancel\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002180-00000C2C-2232300088\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002180-00000C2C-2232300128\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"astx_setup.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"astx_setup.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"astx_setup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002504)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"V3Medic.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005140)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"astx_setup.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002504)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"V3Medic.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005140)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"astx_setup.exe\" called \"IsWow64Process\" with parameter \"2504\" - (UID: 00000000-00002504)\n \"V3Medic.exe\" called \"IsWow64Process\" with parameter \"5140\" - (UID: 00000000-00005140)\n \"ASDCli.exe\" called \"IsWow64Process\" with parameter \"3768\" - (UID: 00000000-00003768)\n \"ASDSvc.exe\" called \"IsWow64Process\" with parameter \"2180\" - (UID: 00000000-00002180)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$3c","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"astx_setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002504)\n \"V3Medic.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005140)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"ASDCli.exe\" called \"OpenMutexW\" with parameter \"Global\\AnfdShMu0x1F12\" - (UID: 00000000-00003768)\n \"ASDSvc.exe\" called \"OpenMutexW\" with parameter \"Global\\JK_1DC1435B-CAF2-463a-B7AD-028434C6B5D5_899e2d662c2bcb3a\" - (UID: 00000000-00002180)\n \"ASDSvc.exe\" called \"OpenMutexW\" with parameter \"Global\\JK_E4328CF5-43F3-4d33-AB49-F08B5B0702E7_899e2d662c2bcb3a\" - (UID: 00000000-00002180)\n \"ASDSvc.exe\" called \"OpenMutexW\" with parameter \"Global\\JSYOUAHWKEYE78\" - (UID: 00000000-00002180)\n \"AKDVE.exe\" called \"OpenMutexW\" with parameter \"Global\\JSYOUAHWKEYE78\" - (UID: 00000000-00006296)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"astx_setup.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002504)\n \"V3Medic.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005140)\n \"SysX64.exe\" called \"LookupAccountSidW\" with param Name Everyone (UID: 00000000-00007544)\n \"SysX64.exe\" called \"LookupAccountSidW\" with param Name ALL APPLICATION PACKAGES (UID: 00000000-00007544)\n \"SysX64.exe\" called \"LookupAccountSidW\" with param Name Everyone (UID: 00000000-00001760)\n \"SysX64.exe\" called \"LookupAccountSidW\" with param Name ALL APPLICATION PACKAGES (UID: 00000000-00001760)\n \"SysX64.exe\" called \"LookupAccountSidW\" with param Name Everyone (UID: 00000000-00006588)\n \"SysX64.exe\" called \"LookupAccountSidW\" with param Name ALL APPLICATION PACKAGES (UID: 00000000-00006588)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"V3Medic.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005140)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"SysX64.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00009068)\n \"SysX64.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007544)\n \"SysX64.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001760)\n \"SysX64.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006588)\n \"SysX64.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003492)\n \"ASDCli.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; File: \"softokn3.dll\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found string \"select * from %s where rowid=0\" (Indicator: \"select * from \"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")\n Found string \"SELECT * FROM T_LOG_EVENT\" (Indicator: \"select * from \"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")\n Found string \"SELECT * FROM T_LOG_SECURITY\" (Indicator: \"select * from \"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"astx_setup.exe\")\n file/memory contains long string with (Indicator: \"FindWindowExW\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001180-39117-135-008D1F4F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001180-39117-135-008D1F4F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$42","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"DnsGetCacheDataTable\" (Indicator: \"DnsGetCacheDataTable\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"astx_setup.exe\")\n file/memory contains long string with (Indicator: \"FindWindow\"; File: \"nsExec.dll\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001760.00000000.201943.0040F000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"astx_setup.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")\n Found reference to API \"[CLogImpl::GetMD5] PathFileExists (Ret:%u) [Path:%s]\" (Indicator: \"PathFileExist\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")\n Found reference to API \"[CLogImpl::GetSHA256] PathFileExists (Ret:%u) [Path:%s]\" (Indicator: \"PathFileExist\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"$47","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$48","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$49","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"certutil.exe\" queries volume information of \"C:\\\" at 00000000-00001180-00000C17-2151672619\n \"certutil.exe\" queries volume information of \"C:\\\" at 00000000-00001180-00000C17-2151989525\n \"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00005148-00000C17-2166112520\n \"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00000772-00000C17-2169913718\n \"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00007924-00000C17-2175399845\n \"ASDCli.exe\" queries volume information of \"C:\\\" at 00000000-00005236-00000C17-2224797772\n \"ASDSvc.exe\" queries volume information of \"C:\\\" at 00000000-00002180-00000C17-2226143963\n \"ASDSvc.exe\" queries volume information of \"C:\\\" at 00000000-00002180-00000C17-2229313268\n \"ASDSvc.exe\" queries volume information of \"C:\\\" at 00000000-00002180-00000C17-2229317429\n \"ASDSvc.exe\" queries volume information of \"C:\\\" at 00000000-00002180-00000C17-2229466958\n \"ASDSvc.exe\" queries volume information of \"C:\\\" at 00000000-00002180-00000C17-2229471010","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"astx_setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"V3Medic.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"SysX64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"certutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ASDCli.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ASDSvc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AKDVE.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"SysX64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ASDCli.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ASDSvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{B2D802D3-48BD-4716-BDAE-D0FAF14A02CF}\")\n \"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{19DD1D8D-927F-45DF-ADF4-75D38267848D}\")\n \"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\V3MEDIC.EXE\")\n \"ASDSvc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ASDSVC.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"ASDSvc.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"AI7z20.dll\")\n file/memory contains long string(File: \"RestoreU.exe\")\n file/memory contains long string(File: \"AhnI2t.dll\")\n file/memory contains long string(File: \"SysARM64.exe\")\n file/memory contains long string(File: \"AhnUpCtl.dll\")\n file/memory contains long string(File: \"V3Hunt.dll\")\n file/memory contains long string(File: \"tsPatcha.dll\")\n file/memory contains long string(File: \"SysX64.exe\")\n file/memory contains long string(File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$4e","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"astx_setup.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\ (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\nsuE86E.tmp (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\asfEA63.tmp (UID: 00000000-00002504)\n \"astx_setup.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\asfEA63.tmp\\Engine (UID: 00000000-00002504)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$4f","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"astx_setup.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002504)\n \"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004292)\n \"V3Medic.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005140)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$50","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"gms001.ahnlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"211.115.106.204:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$51","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"astx_setup.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")\n Found reference to API \"AntiStealthRegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"astx_setup.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /C \"ECHO Y| cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00002504-00000C47-5499525348\")\n Found string \"%WINDIR%\\system32\\cmd.exe /C \"ECHO Y| cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002504-00000C47-5499525348\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule64 Failure. %d, %S, %S\" (Indicator: \"LoadModule\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"SymLoadModule64 Failure.\" (Indicator: \"LoadModule\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"SymLoadModule64\" (Indicator: \"LoadModule\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"astx_setup.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsExec.dll\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001760.00000000.201943.0040F000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001760.00000000.201943.0040F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"astx_setup.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"astx_setup.exe\" with parameter %TEMP%\\ (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter C:\\Users (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter %TEMP%\\nsuE86E.tmp (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter %TEMP%\\asfEA63.tmp (UID: 00000000-00002504)\n \"astx_setup.exe\" with parameter %TEMP%\\asfEA63.tmp\\Engine (UID: 00000000-00002504)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$5e","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Executes echo command","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /C \"ECHO Y| cacls %TEMP%\\\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)\"\" (UID: 00000000-00004292)\n Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /S /D /c\" ECHO Y\"\" (UID: 00000000-00008048)","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":1,"id":"target-343","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"SysX64.exe\" failed to load missing module \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\StCtInstENU.dll\" - [base:0; Status:c0000135]\n \"SysX64.exe\" failed to load missing module \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\StCtInstLOC.dll\" - [base:0; Status:c0000135]\n \"certutil.exe\" failed to load missing module \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release/nssckbi.dll\" - [base:0; Status:c0000135]\n \"ASDCli.exe\" failed to load missing module \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\nzpluginENU.dll\" - [base:0; Status:c0000135]\n \"ASDCli.exe\" failed to load missing module \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\nzpluginLOC.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$5f","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\a9b3b9692efa7e3a94fc9d1971458ce7684f4545\n Found string - \\\\.\\pipe\\{2888D918-4FD6-4d97-9D34-F9122562A026}_\n Found string - \\\\.\\pipe\\%s","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$60","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"V3Medic.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 76890000\n \"certutil.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 81BD0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 81BD0000\n \"ASDSvc.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 81BD0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$61","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"V3Medic.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73230000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$62","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"astx_setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77680000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77680000\n \"cacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77680000\n \"V3Medic.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77680000\n \"SysX64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81C50000\n \"certutil.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81C50000\n \"certutil.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77680000\n \"CheckNetIsolation.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81C50000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81C50000\n \"ASDCli.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81C50000\n \"ASDSvc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81C50000\n \"AKDVE.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81C50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$63","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"astx_setup.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"V3Medic.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"V3Medic.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\TREATAS\")\n \"V3Medic.exe\" touched \"Network\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Ahnlab\" (Indicator: \"ahnlab\") in Source: screen_1.png\n \"AhnLab\" (Indicator: \"ahnlab\") in Source: screen_4.png\n \"AhnLab, Inc.\" (Indicator: \"ahnlab\") in Source: astx_setup.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$64","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"gms001.ahnlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$66","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"file/memory contains long string(File: \"certutil_.exe\")\n Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00000772.00000000.203245.B0C70000.00000004.mdmp\")\n Found string \"WLDAP32.dll\" (Source: \"00000000-00000772.00000000.203245.B0CE2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"V3Medic.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$68","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$69","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ambassmt.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"StSdk32.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"NzBrcom32.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"V3INet4.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"astx_setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nseE85D.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(File: \"tsmime.dll\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"Found reference to API \"[CLogImpl::RollbackTransaction] %s(ErrCode:%u)\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")\n Found reference to API \"[CLogImpl::RollbackTransaction] Rollback\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"V3Medic.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$6a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$6c","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"astx_setup.exe\" queries basic process information of the \"C:\\astx_setup.exe\" (UID: 2504)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"astx_setup.exe\" reads file \"c:\\astx_setup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$6e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$6f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"astx_setup.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"astx_setup.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"V3Medic.exe\" touched file \"C:\\Windows\\AhnInst.log\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$70","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$71","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"astx_setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsee85d.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"astx_setup.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\asfEA63.tmp\\AhnSec.dat\"\n \"astx_setup.exe\" writes a file \"%TEMP%\\asfEA63.tmp\\AhnSec.dat\"\n \"V3Medic.exe\" writes a file \"C:\\Windows\\AhnInst.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"certadm.dll\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"[CAmbassWrapperPerf::GetDefaultPCName] GetComputerNameExW() was Failed. (%lu)\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"[WorkerThreadProc] setsockopt SO_UPDATE_ACCEPT_CONTEXT fail, WSAGetLastError=%d\" (Indicator: \"setsockopt\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"[WebServerStart] setsockopt SO_CONDITIONAL_ACCEPT fail, WSAGetLastError=%d\" (Indicator: \"setsockopt\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"[WebServerStart] WSAStartup Failed(%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"AcceptThread: WSAStartup Failed(%d).\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"ClientThread: WSASend Failed(%d).\" (Indicator: \"WSASend\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"ClientThread: WSARecv Failed(%d).\" (Indicator: \"WSARecv\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"[WebServerStart] WSAStartup Failed(%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"AcceptThread: WSAStartup Failed(%d).\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"ClientThread: WSASend Failed(%d).\" (Indicator: \"WSASend\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"ClientThread: WSARecv Failed(%d).\" (Indicator: \"WSARecv\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"PeekNamedPipe\"; File: \"nsExec.dll\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"URLDownloadToCacheFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"URLDownloadToCacheFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"[WorkerThreadProc] setsockopt SO_UPDATE_ACCEPT_CONTEXT fail, WSAGetLastError=%d\" (Indicator: \"setsockopt\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"[WebServerStart] setsockopt SO_CONDITIONAL_ACCEPT fail, WSAGetLastError=%d\" (Indicator: \"setsockopt\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet cache entries (API string)","description":"Found reference to API \"FindNextUrlCacheEntryW\" (Indicator: \"FindNextUrlCacheEntry\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"FindFirstUrlCacheEntryW\" (Indicator: \"FindFirstUrlCacheEntry\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-321","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$72","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall set rule name=\"AhnLab Safe Transaction\" dir=in new action=allow program=\"%PROGRAMFILES%\\\\AhnLab\\\\Safe Transaction\\\\StSess.exe\" enable=yes\" (UID: 00000000-00005148)\n Process \"netsh.exe\" with commandline \"netsh advfirewall firewall delete rule name=\"AhnLab Safe Transaction\" dir=in\" (UID: 00000000-00000772)\n Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"AhnLab Safe Transaction\" dir=in action=allow program=\"%PROGRAMFILES%\\\\AhnLab\\\\Safe Transaction\\\\StSess.exe\" enable=yes\" (UID: 00000000-00007924)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.0.0.4\" found in string \"NSIS: 3.06AIS: 3.10.19.138AISRes: 2.0.0.4\"\n Potential IP \"1.0.0.1\" found in string \"DFramework_Ahc: 1.0.0.1ASDFramework_Av: 1.0.0.1ASDFramework_Core: 1.0.0.1ASDFramework_EngineAv: 1.0.0.1ASDFramework_EngineMeD: 1.0.0.1ASDFramework_Fw: 1.0.0.1ASDFramework_Ips: 1.0.0.1ASDFramework_Mdp: 1.0.0.1ASDFramework_Update: 1.0.0.1\"\n Potential IP \"1.2.3.4\" found in string \"%-20s - OID (example): 1.2.3.4\"\n \"2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.4.10\"\n \"2.26.0.15\"\n \"127.0.0.1\"\n \"2.1.0.1\"\n \"2.24.0.31\"\n \"2.24.0.1\"\n \"0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$74","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$75","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found string \"HTTP/1.0 %s\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1\nAccept: */*\nUser-Agent: MeDCore\nConnection: keep-alive\nPragma: no-cache\nCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=\n+x5VZeR43_wkwGP+qIIQ1w==\nmcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=\nk3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=\n\nHost: gms001.ahnlab.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"{{wYk{I3}7X0\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"Contains base62 string in header \"rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAyk\" in header \"GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com\"\n Contains base62 string in header \"k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2\" in header \"GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1Accept: */*User-Agent: MeDCoreConnection: keep-alivePragma: no-cacheCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,Host: gms001.ahnlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"gms001.ahnlab.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"$76","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"V3INet4.dll\"\n YARA signature for Djb2 Hash Algorithm matched on file \"ambassmt.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"[CCloudScanDBCtrl::GetProcessingCloudItemCount] %s(ErrCode:%u)\" (Indicator: \"gcloud\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found string \"[CCloudScanDBCtrl::QueryProcessingCloudItems] %s(ErrCode:%u)\" (Indicator: \"gcloud\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"InstallOptions.dll\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"AI7z20.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"astx_setup.exe\" tries to directly access volume data \"Z:\"\n \"certutil.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$79","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"astx_setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"V3Medic.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SysX64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SysX64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"certutil.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"V3Medic.exe\" called \"GetComputerNameW\" (UID: 00000000-00005140)\n \"certutil.exe\" called \"GetComputerNameA\" (UID: 00000000-00001180)\n \"certutil.exe\" called \"GetComputerNameW\" (UID: 00000000-00001180)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"V3Medic.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"SysX64.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"astx_setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"astx_setup.exe\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")\n Found reference to API \"[ERROR] WTSEnumerateSessionsW(%u)\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"[CIdleScanHelper::IsUserLogOff] WTSEnumerateSessionsW return FALSE\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found reference to API \"[CIdleScanHelper] WTSEnumerateSessionsW(%u)\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"[CAmbassWrapperPerf::GetLocalIp] GetAdaptersAddresses() return %u\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"astx_setup.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"[CAmbassWrapperPerf::GetDefaultPCName] GetComputerNameExW() was Failed. (%lu)\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"astx_setup.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"astx_setup.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$81","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$82","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\%s\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002180.00000000.206903.58A31000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"[ConvertProxyHostNameToRealIPAddr dwRetVal = %d] HostName %S,UrlPath %S\" (Indicator: \"hostname\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")\n Found string \"[CEnumUserInfo::UpdateAllVariablesForRegistry] reg query err, %s, %u\" (Indicator: \"reg query\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")\n Found string \"hostname mismatch\" (Indicator: \"hostname\"; Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"tnnipsct.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"tnfwct.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"tnhipsct.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"V3ElamCt.dll\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"astx_setup.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"astx_setup.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"astx_setup.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"ASDSvc.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002180)\n \"AKDVE.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006296)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$84","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$88","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"astx_setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$89","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$8a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$8b","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"astx_setup.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001760.00000000.201943.0040F000.00000002.mdmp, 00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp, 00000000-00002180.00000000.206903.58A31000.00000002.mdmp, 00000000-00002180.00000000.206903.59099000.00000002.mdmp, 00000000-00002180.00000000.206903.5A84B000.00000002.mdmp, 00000000-00002180.00000000.206903.EF7CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$8c","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"$8d","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"astx_setup.exe\" opened \"\\Device\\KsecDD\"\n \"SysX64.exe\" opened \"\\Device\\KsecDD\"\n \"certutil.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"\n \"ASDCli.exe\" opened \"\\Device\\KsecDD\"\n \"ASDSvc.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$8e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$8f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"astx_setup.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"astx_setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"rundll32.exe,csrss.exe,services.exe,wininit.exe,svchost.exe\" (Source: \"00000000-00002180.00000000.206903.58A31000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$90","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$91","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"key4.db-journal\" - Location: [%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\key4.db-journal]- [targetUID: 00000000-00001180]\n Dropped file: \"key4.db-journal\" - Location: [%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\key4.db-journal]- [targetUID: 00000000-00001180]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$92","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"astx_setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"V3Medic.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"certutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"informative","category":"Unusual Characteristics","name":"Uses certutil from the Windows Certificate Services","description":"Process \"certutil.exe\" (UID: 00000000-00008584)\n Process \"certutil.exe\" (UID: 00000000-00004516)\n Process \"certutil.exe\" (UID: 00000000-00001180)\n Process \"certutil.exe\" (UID: 00000000-00008084)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-60","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"certutil.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1180)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"DbgHelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002180.00000000.206903.10202000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"General","name":"GETs files from a webserver","description":"\"GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1\nAccept: */*\nUser-Agent: MeDCore\nConnection: keep-alive\nPragma: no-cache\nCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,\nHost: gms001.ahnlab.com\" Response ==> HTTP/1.1 200 OK\nServer: nginx\nDate: Wed\n 07 Jan 2026 09:13:39 GMT\nContent-Type: application/octet-stream\nContent-Length: 71\nConnection: keep-alive\nCache-Control: no-cache\n no-store\n must-revalidate\nPragma: no-cache with response body ==>33353A37343A34373A36323A33353A33393A37343A34343A35313A34323A35613A36393A36383A34353A33393A35373A34613A34613A35393A33363A33393A37.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"ASDCli.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)\n \"ASDCli.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"ASDCli.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"V3Medic.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nst3FC5.tmp\\e\\drvinfo_astx.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"$93","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$94","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"ASDCli.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"AHNLAB SAFE TRANSACTION APPLICATION\"; Value: \"\"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\stsess.exe\" /tray\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$95","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 211.115.106.204 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\%s\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00000772.00000000.203245.AD03C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"certutil.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"0\"}\n \"certutil.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"130\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$96","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"V3Medic.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"V3Medic.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}\n \"V3Medic.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"V3Medic.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"V3Medic.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"certutil.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"0\"}\n \"certutil.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"130\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$97","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"$98","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"certutil.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00001180)\n \"certutil.exe\" called \"GetDriveTypeA\" with parameter Z:\\ (UID: 00000000-00001180)\n \"AKDVE.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006296)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"\"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil\" -A -n \"ASTxRoot2\" -d sql:\"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\" -t \"C\n\n\" -i \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der\"\" (Indicator: \"mozilla\\firefox\\\") in Source: certutil.exe\n \"\"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil\" -A -n \"ASTxRoot2\" -d \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\" -t \"C\n\n\" -i \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der\"\" (Indicator: \"mozilla\\firefox\\\") in Source: certutil.exe","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /C \"ECHO Y| cacls %TEMP%\\\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)\"\" (UID: 00000000-00004292)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal Firefox browser credentials","description":"\"certutil.exe\" trying to access file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\key4.db\"\n \"certutil.exe\" trying to access file \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\key4.db\"\n \"certutil.exe\" trying to access file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\key4.db\"\n \"certutil.exe\" trying to access file \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\key4.db\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-181","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$99","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":3,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"certutil.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00001180)\n Process \"certutil.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00008084)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"V3Medic.exe\" at 00000000-00005140-00000C15-2193389762\n \"V3Medic.exe\" at 00000000-00005140-00000C15-2193393351\n \"ASDSvc.exe\" at 00000000-00002180-00000C15-2232625225\n \"ASDSvc.exe\" at 00000000-00002180-00000C15-2232629926","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Reads Antivirus engine related registry keys","description":"\"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\AHNINST\")\n \"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\")\n \"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\")\n \"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\ASDF\")\n \"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\ASDF\\SAFETRANSACTION\")\n \"V3Medic.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\AHNINST\\218\")\n \"SysX64.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\ASDF\\SAFETRANSACTION\")\n \"SysX64.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\")\n \"SysX64.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\ASDF\\SAFETRANSACTION\"; Key: \"DEBUGLOG\")\n \"SysX64.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\"; Key: \"INSTALLPATH\")\n \"SysX64.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\AHNINST\")\n \"SysX64.exe\" (Path: \"HKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\STCTINST\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Cryptographic Related","name":"Able to use RSA keys for encryption and decryption","description":"Found RSA private key marker \"-----BEGIN RSA PRIVATE KEY-----\" in \"-----BEGIN RSA PRIVATE KEY-----\" (Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")\n Found RSA private key marker \"-----END RSA PRIVATE KEY-----\" in \"-----END RSA PRIVATE KEY-----\" (Source: \"00000000-00001760.00000000.201943.5A84B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":6,"id":"string-799","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$9a","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: MeDCore","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$9b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall set rule name=\"AhnLab Safe Transaction\" dir=in new action=allow program=\"%PROGRAMFILES%\\\\AhnLab\\\\Safe Transaction\\\\StSess.exe\" enable=yes\" (UID: 00000000-00005148)\n Process \"netsh.exe\" with commandline \"netsh advfirewall firewall delete rule name=\"AhnLab Safe Transaction\" dir=in\" (UID: 00000000-00000772)\n Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"AhnLab Safe Transaction\" dir=in action=allow program=\"%PROGRAMFILES%\\\\AhnLab\\\\Safe Transaction\\\\StSess.exe\" enable=yes\" (UID: 00000000-00007924)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"cacls.exe\" with commandline \"cacls %TEMP%\\\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)\" (UID: 00000000-00004844)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\") in Source: 00000000-00002180-00000C87-32545015950","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"ASDSvc.exe\" called \"OpenServiceW\" to access the \"wscsvc\" service (\"Windows Security Center\")","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$9c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Persistence","details_count":6,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Modifies firewall settings"},{"detail":"Adds a certificate to the store"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Reads Antivirus engine related registry keys"},{"detail":"References security related windows services"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}]},"activity":{"stats":{"process_count":33,"spawned_processes_count":33,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":62,"imported_dlls_count":215,"dropped_files_count":0,"extracted_files_count":129,"files_written_count":134,"files_deleted_count":0,"registry_keys_created_count":13,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"695e22bb3ed3e6961603aa53","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["KOR"],"submit_name":"astx_setup.exe","analysis_start_time":"2026-01-07T09:09:34+00:00","indicators_count":{"informative":256,"suspicious":67,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"211.115.106.204","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}],"dns_resolutions":[{"domain":"gms001.ahnlab.com","address":"211.115.106.204","ttl":465,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}],"http_requests":[{"host":"gms001.ahnlab.com","host_ip":"211.115.106.204:80","url":"/jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /jk?c=65&p=_y3t7dwtZ_yd8Va3saSRQz2_n0RtzcDjQCJWN4wlpcA=&k=1 HTTP/1.1\nAccept: */*\nUser-Agent: MeDCore\nConnection: keep-alive\nPragma: no-cache\nCookie: data=rjnmtSOOhVK8rNZ9Xay25D8axg8OBMAykVDxH8MdpYU=,+x5VZeR43_wkwGP+qIIQ1w==,mcFLMp3cdAk_BjpUhbx9W1AG+5_xLtx5Y610rKe2Pds=,k3IjFIJncjzLqN6WQ6JFxjQjsT9ukaJP2BeWcot+HjM=,\nHost: gms001.ahnlab.com","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}],"processes":[{"pid":2504,"ppid":0,"name":"astx_setup.exe","command_line":"","sha256":"144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a","normalized_path":"C:\\astx_setup.exe","uid":"00000000-00002504","icon":"$9d"},{"pid":4292,"ppid":2504,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /C \"ECHO Y| cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)\"","sha256":"678652bb50abb92de91a69c05ea018c160fb4be0902ace14b15749246788cb40","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002504","uid":"00000000-00004292"},{"pid":8048,"ppid":4292,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" ECHO Y\"","sha256":"678652bb50abb92de91a69c05ea018c160fb4be0902ace14b15749246788cb40","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004292","uid":"00000000-00008048"},{"pid":4844,"ppid":4292,"name":"cacls.exe","command_line":"cacls %TEMP%\\asfEA63.tmp /s:D:PAI(A;;FA;;;BA)","sha256":"26faaa750c27ab778866cbb1cb9900b78dea263768efe366951380e2dac04264","normalized_path":"%WINDIR%\\SysWOW64\\cacls.exe","parent_uid":"00000000-00004292","uid":"00000000-00004844"},{"pid":5140,"ppid":2504,"name":"V3Medic.exe","command_line":"","sha256":"7d1ec7d5c7b15575a78f403bd3095eba875fb41724e8b1f4f6775ceceff29e5b","normalized_path":"%TEMP%\\asfEA63.tmp\\V3Medic.exe","parent_uid":"00000000-00002504","uid":"00000000-00005140"},{"pid":3560,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00003560"},{"pid":9068,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00009068"},{"pid":7544,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00007544"},{"pid":1760,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00001760"},{"pid":8584,"ppid":1760,"name":"certutil.exe","command_line":"certutil -addstore -f root \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der\"","sha256":"a86db7bb74499c976fb00a902b905e3fea2982405344cb0f4966192f50e4dbb5","normalized_path":"%WINDIR%\\SYSTEM32\\certutil.exe","parent_uid":"00000000-00001760","uid":"00000000-00008584"},{"pid":4516,"ppid":1760,"name":"certutil.exe","command_line":"certutil -repairstore root 9c786262fd7479bd \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\astx.inf\"","sha256":"a86db7bb74499c976fb00a902b905e3fea2982405344cb0f4966192f50e4dbb5","normalized_path":"%WINDIR%\\SYSTEM32\\certutil.exe","parent_uid":"00000000-00001760","uid":"00000000-00004516"},{"pid":1180,"ppid":1760,"name":"certutil.exe","command_line":"\"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil\" -A -n \"ASTxRoot2\" -d sql:\"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\" -t \"C,,\" -i \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der\"","sha256":"f5cd860a5f2f08f30813d042e5a8c18e1965e5750aee168050bffe742dcf0dd0","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil.exe","parent_uid":"00000000-00001760","uid":"00000000-00001180"},{"pid":8084,"ppid":1760,"name":"certutil.exe","command_line":"\"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil\" -A -n \"ASTxRoot2\" -d \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\" -t \"C,,\" -i \"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\ca2.der\"","sha256":"f5cd860a5f2f08f30813d042e5a8c18e1965e5750aee168050bffe742dcf0dd0","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Cert\\nss\\certutil.exe","parent_uid":"00000000-00001760","uid":"00000000-00008084"},{"pid":1448,"ppid":1760,"name":"CheckNetIsolation.exe","command_line":"LoopbackExempt -a -n=microsoft.microsoftedge_8wekyb3d8bbwe","sha256":"9c8408ea842aea618328a000d6ab965e6c84d30e4245e38bfcd7149cefc14b79","normalized_path":"%WINDIR%\\SYSTEM32\\CheckNetIsolation.exe","parent_uid":"00000000-00001760","uid":"00000000-00001448"},{"pid":6588,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00006588"},{"pid":5148,"ppid":6588,"name":"netsh.exe","command_line":"netsh advfirewall firewall set rule name=\"AhnLab Safe Transaction\" dir=in new action=allow program=\"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\StSess.exe\" enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\SYSTEM32\\netsh.exe","parent_uid":"00000000-00006588","uid":"00000000-00005148"},{"pid":772,"ppid":6588,"name":"netsh.exe","command_line":"netsh advfirewall firewall delete rule name=\"AhnLab Safe Transaction\" dir=in","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\SYSTEM32\\netsh.exe","parent_uid":"00000000-00006588","uid":"00000000-00000772"},{"pid":7924,"ppid":6588,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"AhnLab Safe Transaction\" dir=in action=allow program=\"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\StSess.exe\" enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\SYSTEM32\\netsh.exe","parent_uid":"00000000-00006588","uid":"00000000-00007924"},{"pid":3492,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00003492"},{"pid":3768,"ppid":3492,"name":"ASDCli.exe","command_line":"/register","sha256":"f74de2d1a5b3b96285f3c081ba498b45d38a64d2c7e57c4bbdb8edb2b585d806","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\ASDCli.exe","parent_uid":"00000000-00003492","uid":"00000000-00003768"},{"pid":1348,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00001348"},{"pid":976,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00000976"},{"pid":8700,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00008700"},{"pid":3664,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00003664"},{"pid":3968,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00003968"},{"pid":6240,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00006240"},{"pid":8168,"ppid":5140,"name":"SysX64.exe","command_line":"","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","normalized_path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","parent_uid":"00000000-00005140","uid":"00000000-00008168"},{"pid":5236,"ppid":8168,"name":"ASDCli.exe","command_line":"/start","sha256":"f74de2d1a5b3b96285f3c081ba498b45d38a64d2c7e57c4bbdb8edb2b585d806","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\ASDCli.exe","parent_uid":"00000000-00008168","uid":"00000000-00005236"},{"pid":2180,"ppid":0,"name":"ASDSvc.exe","command_line":"","sha256":"bea329029ac0b3de5369cf68805d231e8c08e542b0d4817733ce3aa311f4205c","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\ASDSvc.exe","uid":"00000000-00002180","icon":"$9e"},{"pid":6296,"ppid":2180,"name":"AKDVE.exe","command_line":"1111111011010000000000000000000_AntiStealth_SafeTransactionF","sha256":"d6f0d2249246715dbb0ac5541facce2a31b10e4e0ef3ccdd9738e746e5f452f1","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\AKDVE.exe","parent_uid":"00000000-00002180","uid":"00000000-00006296"},{"pid":4088,"ppid":2180,"name":"AKDVE.exe","command_line":"1111111100000000000000000000000_AntiStealth_SafeTransactionF","sha256":"d6f0d2249246715dbb0ac5541facce2a31b10e4e0ef3ccdd9738e746e5f452f1","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\AKDVE.exe","parent_uid":"00000000-00002180","uid":"00000000-00004088"},{"pid":2508,"ppid":2180,"name":"AKDVE.exe","command_line":"1111111100000000000000000000000_AntiStealth_SafeTransactionF","sha256":"d6f0d2249246715dbb0ac5541facce2a31b10e4e0ef3ccdd9738e746e5f452f1","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\AKDVE.exe","parent_uid":"00000000-00002180","uid":"00000000-00002508"},{"pid":7488,"ppid":2180,"name":"AKDVE.exe","command_line":"1111111100100000000000000000000_AntiStealth_SafeTransactionF","sha256":"d6f0d2249246715dbb0ac5541facce2a31b10e4e0ef3ccdd9738e746e5f452f1","normalized_path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\AKDVE.exe","parent_uid":"00000000-00002180","uid":"00000000-00007488"}],"all_imported_dlls":["libcrypto-1_1-x64.dll","wow64win.dll","wintrust.dll","rsaenh.dll","winnsi.dll","mswsock.dll","netprofm.dll","sppc.dll","Ips.dll","oleaut32.dll","ntmarta.dll","comdlg32.dll","TextShaping.dll","imagehlp.dll","fwcfg.dll","gpapi.dll","Av.dll","ssl3.dll","softokn3.dll","prxyqry.dll","httpapi.dll","wwancfg.dll","medext.dll","rpcrt4.dll","win32u.dll","ws2_32.dll","propsys.dll","spinf.dll","libplds4.dll","eappprxy.dll","ASDi.dll","ntdll.dll","msvcp_win.dll","AI7z20.dll","msvcp90.dll","winmm.dll","vcruntime140.dll","fwbase.dll","mfc42u.dll","KernelBase.dll","ole32.dll","VxSSL32.dll","sspicli.dll","msls31.dll","netutils.dll","Windows.StateRepositoryCore.dll","cryptnet.dll","gdi32full.dll","InstallOptions.dll","StCtInst.dll","dot3api.dll","netshell.dll","nettrace.dll","winipsec.dll","wevtapi.dll","wow64.dll","setupapi.dll","cfgmgr32.dll","certcli.dll","mobilenetworking.dll","netiohlp.dll","nshhttp.dll","nshwfp.dll","crypt32.dll","System.dll","msvcrt.dll","oleacc.dll","version.dll","rpcnsh.dll","WwanPrfl.dll","TSFltCtl.dll","wow64con.dll","dwmapi.dll","Wldap32.dll","dhcpcmonitor.dll","Mdp.dll","CdmCtrl.dll","NzPlugin.dll","HsbCtl.dll","cryptbase.dll","AhnIEx.dll","cabinet.dll","wwapi.dll","mprmsg.dll","Atampt.dll","medcore.dll","tnnipsct.dll","sechost.dll","shell32.dll","gdi32.dll","secur32.dll","netapi32.dll","freebl3.dll","atstrumt.dll","BtScnCtl.dll","ambassmt.dll","AhnI2t.dll","ntshrui.dll","ntdsapi.dll","FirewallAPI.dll","NetSetupApi.dll","NzInst.dll","eappcfg.dll","umpdc.dll","AHAWKE.DLL","nsExec.dll","msvcp110_win.dll","ifmon.dll","tdh.dll","winhttp.dll","msvcp60.dll","Fw.dll","wtsapi32.dll","fltLib.dll","shlwapi.dll","MFC90ENU.DLL","rtutils.dll","Core.dll","TNNetUtil.dll","advapi32.dll","WinTypes.dll","riched20.dll","linkinfo.dll","libssl-1_1-x64.dll","userenv.dll","windows.storage.dll","nshipsec.dll","samcli.dll","WcnNetsh.dll","wlanapi.dll","wow64cpu.dll","mfc90u.dll","nssutil3.dll","cryptsp.dll","apphelp.dll","msvcr90.dll","libnspr4.dll","AhnCtlKd.dll","msi.dll","wininet.dll","imm32.dll","msasn1.dll","whhelper.dll","wlancfg.dll","clbcatq.dll","certca.dll","rasmontr.dll","rasman.dll","onex.dll","mfc42.dll","rasadhlp.dll","ntasn1.dll","devrtl.dll","rasapi32.dll","hnetmon.dll","activeds.dll","wshelper.dll","wcmapi.dll","AhnI2.dll","bcryptprimitives.dll","CoreUIComponents.dll","srvcli.dll","Windows.System.Launcher.dll","cscapi.dll","ktmw32.dll","ucrtbase.dll","combase.dll","kernel.appcore.dll","usp10.dll","CoreMessaging.dll","ncrypt.dll","sqlite3.dll","dnsapi.dll","user32.dll","shfolder.dll","msctf.dll","smime3.dll","authfwcfg.dll","PdCfg.dll","powrprof.dll","uxtheme.dll","VxSSL64.dll","bcrypt.dll","logoncli.dll","nsi.dll","nss3.dll","polstore.dll","adsldpc.dll","kernel32.dll","SHCore.dll","TextInputFramework.dll","dsrole.dll","fwpolicyiomgr.dll","dot3cfg.dll","p2pnetsh.dll","P2P.dll","wow64base.dll","msimg32.dll","cryptui.dll","FWPUCLNT.DLL","PeerDistSh.dll","slc.dll","CdmAPI.dll","comctl32.dll","profapi.dll","IPHLPAPI.DLL","urlmon.dll","psapi.dll","drvstore.dll","mprapi.dll","sstpcfg.dll","iertutil.dll","normaliz.dll","libplc4.dll","dhcpcsvc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AhnIEx.dll","sha256":"c7919733e8ca38b70c539284dc005032ca060974ee526b2067b8b037135cfd86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ambassmt.dll","sha256":"421640662b2cf7e6d49e30f2bf144886a91d86f94cde9bdae6741f2232116a78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASDCli.exe","sha256":"f74de2d1a5b3b96285f3c081ba498b45d38a64d2c7e57c4bbdb8edb2b585d806","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASDCr.exe","sha256":"2ebdf51f51c3790393af0869bb040907e588952a3b6f8bb47c7832bdf5ea6fe4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASDSvc.exe","sha256":"bea329029ac0b3de5369cf68805d231e8c08e542b0d4817733ce3aa311f4205c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASDUp.exe","sha256":"b296dcfde354f7be82fdd19dda22d13607361fdf8759531d35d6bfa4f3b24e4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASDWsc.exe","sha256":"94f502d47e5d775cb9aba572089532ec4066c921c9fe1d099e98275180db4adf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASDi.dll","sha256":"c599323742452b3681f4add510133ba55337cc28fe4cef583ee67c6a82fdfa6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AhnUp.dll","sha256":"36e722b78a408193629e91bbbc63440870b8e88fdd3241c5be0d1160a6072485","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Ark64.dll","sha256":"a54492f58f953c967fa7aba1094ec9ae95e0dbdd74b4b3bc2040b5181c72116e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Ark64lgplv2.dll","sha256":"7f90f7a9254f0ffa6f37ffb9841fe76a8697d69b4ea24996ba99ca08cb5b71cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Atampt.dll","sha256":"44a901ea143208c4063073f8803ba5053ce59530a7864674ebcffb84a4b0914f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AtamptU.dll","sha256":"3e2ccdc2b209c030ccf07b8e2ddd7299941f8bc87bc6fd1391f5f41c4070e349","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AupASD.exe","sha256":"7bb93114a0c5ed07e2df4331f4531c0cd320530570e5c1c377d15b5c39ba242e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Av.dll","sha256":"b221875cb9f605f53f93e7f5418cb4b9ae477faf8276409da0fa78c0a301edbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"CdmAPI.dll","sha256":"6d28b85e35128fd5265091eea7287773007f7c453a2c9b38475c11e61ef87e21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Core.dll","sha256":"557547195c5d17d7e19d09fac63f9f6dd83fe459d3c7a029483f4612122ae6ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Fw.dll","sha256":"37df6e27ba1b7620fbff6c9f3c67660a5ea45e5f1dfbc88139faa31f79fd231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"HsbCtl.dll","sha256":"220c6bb76d9140c112b99c57bd5261353fa3e2746613e398dcb4f1cce6eed4d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"HsbCtl32.dll","sha256":"f4d54da9baad38ef75e1e23c3ea7f7f1aaa4dae243c24aa8e78a73ee16566a6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Ips.dll","sha256":"3730189b71096807d35a5ba1c7fac31436be336afb260531bb706d09413d9c09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Mdp.dll","sha256":"44fb708b25733ea278344acecad1e2a6da57a671e67ba807e1c84d16491c112e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"NzBrcom.dll","sha256":"6584cce75a253fcd46552262b098af1e50dbb50210558e1513ea35adb6740858","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"NzBrcom32.dll","sha256":"5f6c8d38646e041a21a85300a9d1672a948677ebfe12147b6dc5159c8f30ff53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"NzInst.dll","sha256":"bbf7ae4f5a965982efa714ce4c500769ba023f2f7def63595fd7c5a9f0721ed3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"NzInst32.dll","sha256":"1ae7efbcdafc8df52fbf1b2dc45c099458e9fbe53d473d04daf9a8be497beac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"NzPlugin.dll","sha256":"1bec506130e7961e7805d7b93129e4ea0b74a99857e49aab7678c4f35ca65ad6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"PdCfg.dll","sha256":"ed9fa04b7a20ddd65480cc071e97d1e532f399a212b5e2a41372c978215aae5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"RestoreU.exe","sha256":"6de0abab2f174c4354c525f813ce1d90b8bfb8c01d1e5b8c20551c313a814908","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"SCTX.exe","sha256":"70feb07c11fa6b5812adfdfd91f13afd0789ba6bca9701ebb7639260d815a336","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ScrMon32.dll","sha256":"abd7b1b158de1aeda3fad764a3d4b647bcca5b329d7f83cff0b03caba812eb49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StCli.exe","sha256":"509b141ce5d21f941851aa397045efe5491bcd09bf41c728c38609625b09ba9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StCtInst.dll","sha256":"4b67704bb456f02392ba5db2d2fef7422a1f4aacf85f2a1b5b7aa768cf461c8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StCtl.dll","sha256":"8857f09cd0675a75d0417cf7b8440d728036d8454ca20dab6fce14c70f678b14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StCtl32.dll","sha256":"1369b0870c696fd05b7f3df701f38396b83e9c1251109576d905f4c93c5935fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StSdk.dll","sha256":"3a6a833fab95fcd051d16cf01c9a753cf3699594dff7436ec4e58e860689a4b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StSdk32.dll","sha256":"7e5b2bf81a192171c502018edbd85c100a9c9c595226443cc0a7ecf919c361e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StSess.exe","sha256":"e67aecd060dc3878e312d76f610a42b7795942000b5fa206678bae38cb5a2481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StSess32.exe","sha256":"6e9e2f733fce7145f5c4aacca51c8ace209aaa5055c024efa31587270c0259e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"StSvr.dll","sha256":"5a5b6295792c0c74a2f5194c7bb94bccc5d7f4a4548a0cd1396a161b1c596c66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"TNNetUtil.dll","sha256":"30b25224f332cd364348b321ba08f88d0cfa736f7a676e718875d955a8e7c52b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"TSFltCtl.dll","sha256":"3d24b7bc6d34338f07ddaa157b276d20cd8a486e86489ce3c68264fed8916018","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"UpEx.dll","sha256":"ccee97e9053998e8ea1e6eddd3486b13bfe4fdc453f8e3590a7e32c2b5a51e0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"V3Cert.dll","sha256":"0ee0f8c66da70d6243ef39b51fee96c369b770afa1d2b80782ca7ad5fb43bbf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"V3Hunt.dll","sha256":"0fad5eeffb04c6d5b3cdb3da201a7b8df2d898a0a022e3afed5e57903452f111","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"V3INet3.dll","sha256":"b0a69058e4c7d51a59add229afa0dd5a9f633be04e57a9b700178cc849185ba2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"V3INet4.dll","sha256":"72b7379c4944af67d0c3cb9a1ef080dfee5aee71e45549fc73124d837307ac0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ahloha.dll","sha256":"29d6109a021616b09902db553d60def45ff7d192f6cf00be0d6e73c7707a8296","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"aostrust.dll","sha256":"23eb25fcc905b8b4c9b9da546f68b54fa9c5bf391aa3bf9bc93e81159219014e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"aostrust32.dll","sha256":"f6c0bf461fe779111ca041f8ee603b17d57644bdbc371fb5686595ba22dd3bf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"asc_main.dll","sha256":"49b50090c31699e7d2de6f81d292990f5458c5e432af5a1fb3fd83e7b5d391fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"atstrumt.dll","sha256":"53d2bb0fda6d824551c9a81a101bcaef861a94ae96941d96a34748579708ffb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"atstrust.dll","sha256":"c17f1ac64bb989c41d56702ab5d636fc4c7b3bf647908cc1ebdf02e6c737adcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"freebl3.dll","sha256":"c2c14b2e86f3f683c5bc80b86c56aa83e73833a3feb5d1715bcac8413aaab847","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"libcrypto-1_1-x64.dll","sha256":"df15d3609056b461b31a3cf39488995cceb27cf6d62cb31e308ba5a79a9f0bff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"medcore.dll","sha256":"18382a954f129e5d6a9ce642dfc41d18435eda9334c6672454a1a95607e71aef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"medext.dll","sha256":"b55afd0e23a136fcd983c2b70c4ca0c5a10c4ae7535f951ce3bc1909e170c84a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"medvphku.dll","sha256":"ca506ac2617a317b852a838ef997463dfcd7d15a38966d42f59212843fb55834","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"medvphkuw6.dll","sha256":"cb55b19cef444ccb6b81966936f7e70e0e6d23c36a37c33a8425e9b0b29b1388","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"mkd25.dll","sha256":"c45ffaad8c85b4abb41083cecfa3808a831d254ac2c15959b200c6c28a46f33c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"mkd2564.dll","sha256":"cf71ea0272aaa14287e83f551e7b0d4c32d08a9bdb85771fe772244267657bee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"mspatcha.dll","sha256":"87de28ca17e7497023e5ed8165ea569c9881b5a588d752f2819c0c3c48b0c318","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"powapi.dll","sha256":"c75396349efb94f54576e198ffee549a8cc60d4f744b44eef08fcee1b275b4a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"powapi32.dll","sha256":"82273aa90c78a1c4017d202b9ffd5df82ffaae6f33c9d033bf542c62dc4394ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"sqlite3.dll","sha256":"24e612fd5b239aa6385d2c159b70155968b3f9ccdbf19ba7fd83a83b9255238a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"tnfwct.dll","sha256":"f2ac6503b46ef286ddaa6ae0bfb528b3c6aff59c861da0516486b40220aef7c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"tnhipsct.dll","sha256":"46606c98efeabf9da01ec0b17ecfa58aebb07bc719b7fbe7096ce2c1e97b2583","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"tnnipsct.dll","sha256":"d3123a75bb19dac8b9d63b741dafbff4e0a511b51c45fe9cfcbcdb05e00ace0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"trueeyesu.dll","sha256":"e3f15f2ae20835dc5a01cda35150fb00b553fd3d09481c00be52e0338e78d327","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"tsPatcha.dll","sha256":"fb7cc8af125ca27a09b974c233c5e767bd74a02f10f37c60202552496aacffb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"tsmime.dll","sha256":"57029cc81c3536ae4ea5f575ba87b80eda88861e86ae943974113dc33199d022","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AhnLab Report.lnk","sha256":"16e80cf7a0650205ebc402c42178822536b48a2766adf5638f01bda5f8e88060","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AhnLab Safe Transaction.lnk","sha256":"66e0ca3b65aec9d6b5edd2b0baab46f6763aa63c9f12c0f4499d83f8dd897633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Settings.lnk","sha256":"9e26ac8f244b30edbed08d97d88ad8d2ee8c961c89aa2e01de6d0e0b3cbf50d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Uninstall AhnLab Safe Transaction.lnk","sha256":"5a006eabb1a4c755d408a55ad10be6590770bef7bdb82a92823f4a4060311055","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"key4.db-journal","sha256":"a550d9ca767eac84013064e5380d01b0b0c7801fef2714658082e0542d22978a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"cfg.db-journal","sha256":"c73608a33d19a1a07677cb0ea284404b46f03a0ef5be46a31dfc7976e0c10d7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"log.db-journal","sha256":"9795ae5ac0266b1b24ce96fd4f7c5cb6150eb537728863e48bcbfc6dcbfa6360","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"nzdefcfg.db-journal","sha256":"aabb8ab23b0d9fd35b3427b30dbd8064abdc0993c3cdb3f78766d6670e93fed6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"med_arm64.nz","sha256":"a9baf68791fbc9d81f0fcd405be086d27f966b7cc65308bf386d1baa18f17ad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"med_com.nz","sha256":"e3533bdfa1860877ecb4357adb2d29793566117ca811e9dc0a0b9642e066d829","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"med_nt32.nz","sha256":"c171f13c911d00bd13c9ecff384f232bf454481620a864d5c2fdde5a59ca5ec0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"med_x64.nz","sha256":"33bc4ccc488e52e2050c92f3e0554cb2c5deb007ecb6f5a1cb3a33840a8f7728","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"V3Medic.exe","sha256":"7d1ec7d5c7b15575a78f403bd3095eba875fb41724e8b1f4f6775ceceff29e5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASTX_ARM64.nz","sha256":"0e9ff9cc85349c9a820b7b1f86eedc8db41958153011d791333e2421466e9c5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASTX_Common.nz","sha256":"600fbc32a5a025ebf01b34576c09b950203181eaf18174b3800b615b3f9772fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASTX_Install_ARM64.nz","sha256":"363542b157160f49dc9b0495df2aed6e2f5128d585d030e5ba649a5ac652480e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASTX_Install_NT32.nz","sha256":"959502f5fd9a2130c208ec6f69e56f1bd0cf30dd83771f52d1edea05cb081bf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASTX_Install_X64.nz","sha256":"7449a1e6874eb9837881b85d085077cbbf2fcf055b038763388445f5a469922e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ASTX_NT32.nz","sha256":"a354fff8aa1b4a9301679407297fc363d1926aa9b4dff4d7aacb1749674fde0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AI7z20.dll","sha256":"a7ba76c82b7e2e5449ac53106374acf8f1ff8df02f0f311e4bef4f59bdea1f96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AhnI2t.dll","sha256":"5b98f5564f04596f54a2cdfd1e315c72b8613ef5b5e774ef97732139723f19f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"InstallOptions.dll","sha256":"e5e1dae700aacb3fed1ac4725b6ac546b5aeb10a34b57d33767c50b8d117d98e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"SysARM64.exe","sha256":"f5e6c8f3221cf910dc324c19f42a2fcd434d45bf2bbb46d6228c3f64bc70af5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"SysX64.exe","sha256":"af0f128640eb5fa0dc182c7d6dc1ab80549e616fde242f099b166bc43d363e5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AHAWKE.DLL","sha256":"f4e61ac18ec96155d3ed7e41cb31ab624cb9ffcc6d33dad37c23d49a2b0214ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AKDVE.EXE","sha256":"d6f0d2249246715dbb0ac5541facce2a31b10e4e0ef3ccdd9738e746e5f452f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ALWFCtrl.Dll","sha256":"81e0f1cb0b197bd4d2cc4bee233602d3793696bb98bf36e163dacdac49a4c340","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AhnCtlKd.dll","sha256":"34a2e09755d96790e46acd17bd11d85ee8efc5577aa463b9f65ef26f720b3e3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AhnI2.dll","sha256":"0bd223f886f6cd30dde00f4179c704fababe5add84c2fc66c46905dfd405e0c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"AhnUpCtl.dll","sha256":"2c2d0287abe9e53c19ea659437d6ea98a38a356fa2584b14574984a8493b3b6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"BtScnCtl.dll","sha256":"35fa763b764a6b7bbe42bca4bfc6867fdf9a1ef6646e875846909c23cf982d31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"CdmCtrl.dll","sha256":"dd436f989caeb69a1c93b62b6d351443d0a08310f9e0f96c4fcab64e07e543b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"IAccessible2Proxy.dll","sha256":"b2a1a54a5db572380b12eb848e8255c6159faf18b611fa8c1285591328ceac88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"IAccessible2Proxy32.dll","sha256":"6baa623a1e31ea26791230c6df2890fdbedb8143a9b6f9b3ef933c62be5117a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"MUpdate2.exe","sha256":"d886a7c6fd315899674242423b770d92cd719f4b0e8b4b6b8edcb72b766cf6cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"V3ElamCt.dll","sha256":"d03f496e6cfb4f37b293ee0e13d2cd7d309092ee2b8b2f537cd87e67b1c6c385","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"V3INet2.dll","sha256":"c9406f77afd1d69dc4f5540f15a7ff8c2c82aee477b4de2c8fe9666a137ae8f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"WinFWMgr.dll","sha256":"37671eddd5ffb0ab3344cba6e84f51b307a11feea39e94c728f3995ecb781e0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"certutil.exe","sha256":"f5cd860a5f2f08f30813d042e5a8c18e1965e5750aee168050bffe742dcf0dd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"libacm.dll","sha256":"b26d93145cb34ad7ad4ad28ed9900df6ffb6d747a56aa8f93909da360ab14b50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"libnspr4.dll","sha256":"4d0144ecaa36b5ecaa61926c6c851259ba77a019beab639b50251233b1510191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"libplc4.dll","sha256":"44ea74da8042ba84e9d717a441272aa6a199e7ca603477579b8f888357a98119","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"libplds4.dll","sha256":"5b24d860bb9b23ce0aa51607c71e959584317c6a78df9b264e48c456e3211a27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"libssl-1_1-x64.dll","sha256":"7888831fe06edad6f0db8e0e8a90a8ff06941ea1833749316e66b28e20b1584b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"mkd25def.dll","sha256":"8c2f72bf12dd45e6294d5c0aca9eab2e3327fc1179f75f2c01d9be2547979c13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"mkd25def64.dll","sha256":"851b91072114c02e28ae30d298455b590e8d4046fa058c20329a20d0cf4c78a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"mkd25sdk.dll","sha256":"58bc355f81c1f27939102dc931a81185cd591107e804545eca00e1c28cef6f7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"mkd25sdk64.dll","sha256":"cb1ba4361d7df2697c90ae42da67a4befecdad611a73c3dc0bb76e2082c8826f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"nss3.dll","sha256":"7a24c92c9edd0cf9bdc15eae9714aec34173c125b93d5afbfe1b2cbc435b6c6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"nssckbi.dll","sha256":"ebf438683fe6f44252acf8268d79b0837cfbf6e173362ee7ce5e5dd6b13f7923","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"nssdbm3.dll","sha256":"d8d1b52ca77471714469c3e0c7e3497df8b2af7436f27156a887d0d52e577e5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"nssutil3.dll","sha256":"2a1a7247140402084ebe230acf8e7cc5cc94cced94ee4dddb8721bf527b5f080","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"smime3.dll","sha256":"47ed801c6cf1ba6f82788848343df2e6f184f87d015cb31d8b081b4b8289cd8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"softokn3.dll","sha256":"28c0e1f8fbb6307988ad44c74724dc6301ac6ca7e4dcc82607916d94ccaa6540","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"ssl3.dll","sha256":"bcf60ce493436e0a5e4c636344cc312a8ecf0c314210cbd4f703cb70a36c2538","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"vcruntime140.dll","sha256":"65f620bc588d95fe2ed236d1602e49f89077b434c83102549eed137c7fdc7220","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"System.dll","sha256":"18c7e74a71e88ccf61795dcd4e8dff42318cf1cbb3c1777f312dd7b45acb4be3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"nsExec.dll","sha256":"cae8627a46500bab7b8d2fa42586865f6546e78b69300c448e05ae19102c7987","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nsdE687.tmp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nseE85D.tmp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nsuE86E.tmp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nsuE86E.tmp\\AhnIEx.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nsuE86E.tmp\\NSIS.cat","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nsuE86E.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nsuE86E.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\AhnSec.dat","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\BldInfo.ini","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\V3Medic.exe","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\Engine\\med_arm64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\Engine\\med_com.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\Engine\\med_nt32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\Engine\\med_x64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_Common.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_Install_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_Install_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_Install_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_Res.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ASTX_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Av_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Av_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Av_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Core_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Core_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Core_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Fw_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Fw_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Fw_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Ips_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Ips_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Ips_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\License_en_US.txt","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\License_ko_kr.txt","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Mdp_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Mdp_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Mdp_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\Update.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\asdahc.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\astxverify32.dac","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\astxverify64.dac","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\astxverifyarm64.dac","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ckw_ARM64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ckw_DATA.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ckw_NT32.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\asfEA63.tmp\\_Setup\\ckw_X64.nz","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3F75.tmp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nso3FA5.tmp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\NSIS.cat","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\AhnIEx.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\AhnI2t.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\ambassmt.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\AI7z20.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\SysX64.exe","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\SysARM64.exe","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\AIS_PageUnConfirm.ini","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\AIS_PageProgramMaintenance.ini","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%WINDIR%\\AhnInst.log","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\{0D02314D-EC55-4D53-95FD-41183118B518}\\amb.log","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\BldInfo.ini","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\AhnI2.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\AhnI2.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\mfc90u.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\mfc90u.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\Microsoft.VC90.MFC.manifest","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\Microsoft.VC90.MFC.manifest","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\msvcm90.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\msvcm90.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\msvcp90.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\msvcp90.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\msvcr90.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%TEMP%\\nst3FC5.tmp\\e\\NzInst.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\SafeTransaction\\NzInst.dll","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Log\\StSvr.log","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cert9.db","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\key4.db","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cert9.db-journal","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\key4.db-journal","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\pkcs11.txt","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\cert9.db","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\cert9.db-journal","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\key4.db","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\key4.db-journal","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%ALLUSERSPROFILE%\\AhnLab\\AIS\\ASDCli.exe_SafeTransaction.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\DB\\cfg.db","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\DB\\cfg.db-journal","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Log\\ASDi.dll.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Log\\Ips.dll.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\DB\\log.db","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\DB\\log.db-journal","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\DB\\schedule.db","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\DB\\schedule.db-journal","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"pipe\\a9b3b9692efa7e3a94fc9d1971458ce7684f4545","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\private.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\privext.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\url.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\ip.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\scan.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\history.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\reputation.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\prochash.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\mdpsig.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\lfs.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\threat.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\pupdate.ini","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\mdp.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\V3Prtect.dat","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Log\\CORE.dll.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\BTScan.opt","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\Temp\\BTScan","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"path":"%PROGRAMFILES%\\AhnLab\\Safe Transaction\\MeD\\Definition\\geo.asd","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\APPID_CATALOG\\2BCD123D\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\APPID_CATALOG\\07606421\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\APPID_CATALOG\\1B84F968\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\OPTION\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\OPTION\\COMMON\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\ASD\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\REPUMON\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\REPUMON\\LOW\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\REPUMON\\NORMAL\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\REPUMON\\HIGH\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\SAFE TRANSACTION\\OPTION\\AVMON\\","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\AHNLAB\\ASDPCID\\ASDPCID","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2504:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2504:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\_Mutex_AIL_Log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"SM0:2504:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:2504:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:4292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:8048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\AMB_MasslogFilePath","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\AMB_CreateCid","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5140:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:5140:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Global\\_Mutex_AIL_Log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:5140:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"SM0:5140:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5140:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5140:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_Mutex_AIL_Log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\_mutex_ai2_log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\AMB_MultiThreadMutex","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\C:_ProgramData_AhnLab_{0D02314D-EC55-4D53-95FD-41183118B518}_amb.log","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\_Mutex_AIL_SingleInstance_{FF56B785-EF71-461B-AF11-9891E8303723}_ASTX","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\_mutex_ahni2_log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:9068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\c:_program files_ahnlab_safe transaction_log_stsvr.log","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:7544:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:1760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1180:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:1180:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:6588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:5148:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:7924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\c:_program files_ahnlab_safe transaction_log_nzinst.log","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Local\\SM0:3492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_mutex_ahni2_log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\c:_programdata_ahnlab_ais_asdcli.exe_safetransaction.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\c:_program files_ahnlab_safe transaction_log_pdcfg.log","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\CdmSyncMutex","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\c:_program files_ahnlab_safe transaction_log_asdi.dll.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\AnfdShMu0x1F12","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\c:_program files_ahnlab_safe transaction_log_ips.dll.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"Global\\_mutex_ahni2_log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\Global\\_mutex_ahni2_log_","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\601FRC72-A726-49F6-8AC5-A61K01E40F8D","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\JK_1DC1435B-CAF2-463a-B7AD-028434C6B5D5_899e2d662c2bcb3a","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\Global\\JK_1DC1435B-CAF2-463a-B7AD-028434C6B5D5_899e2d662c2bcb3a","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\c:_program files_ahnlab_safe transaction_log_core.dll.logs","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\JSYOUAHWKEYE78","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\{1FF7FA09-7681-4ec5-BF72-0FFA8753374A}_NETSTAT_MUTEX_SafeTransaction","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\E439B07D-8E8A-467d-BCA8-75AD10D7E7F6SafeTransaction","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:6296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"695e22bb3ed3e6961603aa53"}]}]}},"report_ids":{"sandbox_job_ids":["695e22bb3ed3e6961603aa53"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 144f30350453… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 144f30350453…. Threat score 100/100. 0/0 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 144f30350453… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 144f30350453…. Threat score 100/100. 0/0 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/144f303504538fb7d65e2f103ab23381a3d8a2751207106a4537c49730ffd23a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 144f30350453… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 144f30350453…. Threat score 100/100. 0/0 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L9f","11",{}]]