24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.Krypt.Generic Sample 16e030019f05… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 16e030019f05…. Malware family: MSIL.Krypt.Generic. Threat score 100/100. 23/27 AV engines flagged this file. 7 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170","keywords":["Malicious","MSIL.Krypt.Generic","malware analysis","sandbox report","threat intelligence","16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170"],"about":{"@type":"SoftwareApplication","name":"bounty-92647880842270273","applicationCategory":["peexe","assembly","executable"],"identifier":"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.Krypt.Generic","antivirusDetections":{"malicious":23,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T11fb,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-22-00F57381 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-22-00F57381 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-24-00F54119 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-24-00F54119 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-26-00F58020 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-26-00F58020 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-29-00F57D40 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-29-00F57D40 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002392-21117-34-00F5570F Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002392-21117-34-00F5570F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-54-00F55978 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-54-00F55978 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-56-00F57460 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-56-00F57460 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002392-21117-64-00F554CE Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002392-21117-64-00F554CE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-67-00F59475 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-67-00F59475 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002392-21117-68-00F58EDD Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002392-21117-68-00F58EDD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-74-00F57938 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-74-00F57938 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002392-21117-77-00F56B58 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002392-21117-77-00F56B58 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-83-00F538E3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-83-00F538E3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-85-00F5367C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-85-00F5367C Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002392-21117-91-00F59CD3 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002392-21117-91-00F59CD3 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002392-21117-91-00F59CD3 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002392-21117-91-00F59CD3 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002392-21117-91-00F59CD3 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002392-21117-91-00F59CD3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-101-00F5821E Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002392-21117-101-00F5821E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-101-00F5821E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-102-00F582B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-102-00F582B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-115-00F54DD0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-115-00F54DD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-119-00F53C1E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-119-00F53C1E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002392-21117-136-00F527E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002392-21117-136-00F527E0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002392-21117-159-00F52552 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002392-21117-159-00F5255226:Tdc1,Found reference to API "FindWindowEx" (Indicator: "findwindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "_FindWindow_" (Indicator: "findwindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "_SendMessage" (Indicator: "sendmessage"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindow_" (Indicator: "findwindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "SendMessage_" (Indicator: "sendmessage"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindow" (Indicator: "findwindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") file/memory contains long string with (Indicator: "sendmessage"; File: "Microsoft Corporation.exe") Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; Source: "00000000-00007388-00000C2B-1199552356") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00007388-00000C2B-1199552388") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "FindWindowEx" (Indicator: "findwindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "_FindWindow_" (Indicator: "findwindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "_SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "FindWindow_" (Indicator: "findwindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "SendMessage_" (Indicator: "sendmessage"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")27:T2a88,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000005e745cf4b3ea587200020f01687dde73a8f10f0150185972ba7d0987feffffffc4f00f01d27c577268f00f010000617560f10f01eb7c5772e0df297508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000f0f00f01000000000800000000000000000000000000000000000000000000000000000046745cf40000000030f10f016992db76ffffffff34000000f0f00f0108000000000000000000617560f10f012794db76f8f00f010b0000000000000048f10f01 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000001203dc011203dc0a120300000000d80a12030000000070f80f015916f77640000000000000000000000000002803000000004800000000000000000000000900000002000000000028034000000000000000967c5cf490f80f01ee13f77600000000ee13f77600000000000000002c8d397200f90f01ccf80f01cc47e3710000280300000000eb47e37197201473010000002c8d39720000000000000000205ce5760000280308f90f010c1a3272ffffffffeb47e3714a48e37100002803000000004000000014f90f018543e37188b629038848e3714f211473010000002c8d397200000000cb000000020000003cf90f01b0fc3372ffffffff8848e371 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000200000000001203dc011203dc0a120300000000d80a12030000000070f80f015916f77640000000000000000000000000002803000000004800000000000000000000000900000002000000000028034000000000000000967c5cf490f80f01ee13f77600000000ee13f77600000000000000002c8d397200f90f01ccf80f01cc47e3710000280300000000eb47e37197201473af67f27197201473010000002c8d39720000000034f90f01e8f80f0158752f72ffffffffaf67f271cd67f271af201473010000002c8d39720000000034f90f0110f90f0158762f72ffffffffcd67f271eb67f27147211473010000002c8d39720000000034f90f01 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000070f02903503f2903000000000000000001000000583f290380362803000000000000000064f70f013fc5f7760000000064f70f015dc5f77694f0290310d12903ccb6017208d539720000000000000000000000007cf029032a00397210d12903b4f70f01f301f9769cf70f01020000000096017210d1290390f70f0114d53972e0721d741e02f9760000000070f029032a00000000960172bacb2bccb616f34c8990d74c2e8af500a5a1b63000000000f0f70f0184b601720096017288b62903bcb6017201000000f0f70f0199b601721cd539720100000088b62903b0501d740000000000000000000000001cf90f01 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f0e90f0194e90f01226e3d7500003a05000000002d6e3d75f149fe862d000000ecb78c7518ea0f0100001203c02b2b03308f2a031e0000008000000058e90f0100001203dce90f0170c83e759dd1b2f2feffffff2d000000d0cc9b7527000000ace90f01856a3f751c234475ece90f01f85f3f7508000000bb693e75b2693e758949fe862d000000ecb78c7527000000d0cc9b75c0e90f012d000000d0cc9b7527000000f0e90f01856a3f751c23447538ea0f017e8a9a75ee8c9a75738a9a759ecda1352d000000ecb78c7527000000d0cc9b75b4263a0548263a059ecda13500ea0f01fc52d875ecea0f01e0849a759ed67841feffffff738a9a75 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39ce871199ee871d728147370da2c0340b52b03010000000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c000000f0da2c0301000000020000000200000010000000d426397201000000383d3972a8f00f010100000038f00f017e44e37150632b0368f00f013f44e3715844e3713328147370da2c03a8f00f0101000000000000000000000084f00f01e88b3172ffffffff5844e3711d44e371cb28147370da2c0310d42b03010000001241e9718b28147370da2c0340b52b0300000000fb9ee8719328147370da2c0340b52b0300000000383d39720000000069a7e8710000000070da2c03 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000f0178ef0f01010000000000000002000000005b1d740000000000000000008001000000a703a4ef0f01de81db76100300000400000000000000000000000000000000000000ffffffff0cf00f014336e97110030000040000000000000000000000000000007136e971572814730200000074f00f010000000003000000e0ef0f0100f00f018ecdd97614030000000000000200000000000000000000000200000074f00f010000000018f00f0130ede9718000a703000000000074010030f00f0195f0e9718000a7030000a703000000000074010050f00f0187f1e9718000a7030000a703000000000074010060d32b0300000000b4f00f0163efe971 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39ce871199ee8715f111473007b2d03006b2d0301000000000000000000000000000000000000000000000000000000000000000000000004010000040100000c000000287d2d0301000000020000000200000010000000d426397201000000383d397220c90f0101000000b0c80f017e44e37150632b03e0c80f013f44e3715844e371bb101473007b2d0320c90f01010000000000000000000000fcc80f01e88b3172ffffffff5844e3711d44e37153111473007b2d0300bc2b03010000001241e97113111473007b2d03006b2d0300000000fb9ee8711b111473007b2d03006b2d0300000000383d39720000000069a7e87100000000007b2d03 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39ce871199ee871cb1e1473089d2d03c0652d03010000000000000000000000000000000000000000000000000000000000000000000000ca000000ca0000000c000000a8f62d0301000000020000000200000010000000d426397201000000383d3972acc60f01010000003cc60f017e44e37150632b036cc60f013f44e3715844e371371e1473089d2d03acc60f0101000000000000000000000088c60f01e88b3172ffffffff5844e3711d44e371cf1e1473089d2d0390c32b03010000001241e9718f1e1473089d2d03c0652d0300000000fb9ee871971e1473089d2d03c0652d0300000000383d39720000000069a7e87100000000089d2d03 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39ce871199ee871eb081473a07d2d0380662d0301000000000000000000000000000000000000000000000000000000000000000000000002010000020100000c00000060d62d0301000000020000000200000010000000d426397201000000383d3972ccd00f01010000005cd00f017e44e37150632b038cd00f013f44e3715844e371d7081473a07d2d03ccd00f01010000000000000000000000a8d00f01e88b3172ffffffff5844e3711d44e371ef081473a07d2d03d0c02b03010000001241e971af081473a07d2d0380662d0300000000fb9ee871b7081473a07d2d0380662d0300000000383d39720000000069a7e87100000000a07d2d03 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffffd39ce871199ee8716716147340c72e0320692d03010000000000000000000000000000000000000000000000000000000000000000000000ea000000ea0000000c000000c0c72e0301000000020000000200000010000000d426397201000000383d397258ce0f0101000000e8cd0f017e44e37150632b0318ce0f013f44e3715844e3714316147340c72e0358ce0f0101000000000000000000000034ce0f01e88b3172ffffffff5844e3711d44e3711b16147340c72e0300c72b03010000001241e971db16147340c72e0320692d0300000000fb9ee8712316147340c72e0320692d0300000000383d39720000000069a7e8710000000040c72e03 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007388) "netsh.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002392) "netsh.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002392)28:T833,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000671d74eb7c57720800000004000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff240000000000000084f20f01000000000400000000000000000000000000000000000000000000003117d9711e765cf488f20f01270ef976ffffffff2400000084f20f01 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000053004f0052005f005200450056004900530049004f004e003d0034006600300030000000500072006f006700720061006d0044006100740061003d0043003a005c00500072006f006700720061006d0044006100740061000000500072006f006700720061006d00460069006c00650073003d0043003a005c0050007200 (UID: 00000000-00007388) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000013f776000000000000000080000000e049586f000000008c74db0050723d75000055030000000080000000e049586f02000000a015586fa874db00eb49586f01000000a814596f885f3f7500000000dcd477dbd874db00a84b586f9415586f9815586f0000000000000000fe4b586ff800516f0000dc00b074db0000000000 (UID: 00000000-00002392)29:T13ca,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindowEx" (Indicator: "FindWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "_FindWindow_" (Indicator: "FindWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindow_" (Indicator: "FindWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "56038585361,2516,108,,GetWindowTextA,user32.dll,"00:37:04.078",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56300007263,2516,105,,GetForegroundWindow,user32.dll,"00:37:04.187",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "55512589843,2516,108,,GetWindowTextA,user32.dll,"00:37:03.859",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56825125952,2516,108,,GetWindowTextA,user32.dll,"00:37:04.406",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56038461867,2516,105,,GetForegroundWindow,user32.dll,"00:37:04.078",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56825961777,2516,108,,GetWindowTextA,user32.dll,"00:37:04.406",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "54987679243,2516,105,,GetForegroundWindow,user32.dll,"00:37:03.640",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "54725949331,2516,108,,GetWindowTextA,use" (Indicator: "GetWindowText"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56562739300,2516,108,,GetWindowTextA,user32.dll,"00:37:04.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56037479917,2516,105,,GetForegroundWindow,user32.dll,"00:37:04.078",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "54463174530,2516,105,,GetForegroundWindow,user32.dll,"00:37:03.421",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56825818877,2516,105,,GetForegroundWindow,user32.dll,"00:37:04.406",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "56824932482,2516,105,,GetForegroundWindow,user32.dll,"00:37:04.406",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")2a:T16ab,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00007388) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002392) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002392) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002392) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002392) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00002392) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00002392) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00002392) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002392)2b:T8bfc,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter OleGetClipboard (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SendMessageTimeout (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter SendMessageTimeoutA (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter MessageBox (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00007388) "netsh.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002392) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002392)2c:T4ed6,Found reference to API (Indicator: "Sleep"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetProcessById"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "CompareString"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetObject"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetLogicalDrives"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetTempPath"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetCurrentProcess"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetFileInfo"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "MessageBox"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetTempFileName"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "SetEnvironmentVariable"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetForegroundWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetVolumeInformation"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetWindowText"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetWindowTextLength"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "FindWindowEx"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "FindWindowExA"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "FindWindowA"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "SystemParametersInfoA"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "SendMessage"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "SetWindowPos"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "SystemParametersInfo"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "NtSuspendProcess"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "NtResumeProcess"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "NtSetInformationProcess"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "ShowCursor"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "EnableWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetClassName"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetClassNameA"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "SendMessageA"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "EnumChildWindows"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetWindowTextA"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "FindWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "IsWindowVisible"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "ShowWindow"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "GetAsyncKeyState"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API (Indicator: "RegConnectRegistryW"; File: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; File: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleActiveScreenBuffer"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "RtlGUIDFromString"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005952.00000000.142726.00B10000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetFileInfo"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformation"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "FindWindowEx"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "FindWindowA"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfo"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "NtSuspendProcess"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "NtResumeProcess"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "ShowCursor"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")2d:T88c,"%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe" (Indicator: "%appdata%\microsoft\windows\start menu\programs\startup\microsoft corporation.exe") in Source: 00000000-00007388-00000C3C-19365065904 "USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "device\harddiskvolume2\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe" (Indicator: "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\microsoft corporation.exe") in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\microsoft corporation.exe" (Indicator: "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\microsoft corporation.exe") in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp2e:T24a6,"[Software\Microsoft\Windows\CurrentVersion\Run]" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "Software\" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "Software\Microsoft\Internet Explorer\Main" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "Software\ShortCutInfection" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170 "[Software\\Microsoft\\Windows\\CurrentVersion\\Run]" in Source: 6000015-cctor "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000015-cctor "Software\\" in Source: 6000020-Fransesco~DLV "Software\\Microsoft\\Internet Explorer\\Main" in Source: 6000033-Fransesco~AddHome "Software\\ShortCutInfection" in Source: 600004f-Fransesco~RegValueGet "Software\\Microsoft\\Windows\\CurrentVersion\\Run\\" in Source: 6000057-Fransesco~Ind "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\" in Source: 6000057-Fransesco~Ind "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\" in Source: 6000057-Fransesco~Ind "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" in Source: 6000057-Fransesco~Ind "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\" in Source: 6000057-Fransesco~Ind "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" in Source: 6000057-Fransesco~Ind "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0" in Source: 6000057-Fransesco~Ind "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winsat" in Source: 6000057-Fransesco~Ind "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS" in Source: 6000057-Fransesco~Ind "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" in Source: 6000057-Fransesco~Ind "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile" in Source: 6000057-Fransesco~Ind "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 600005a-Fransesco~INS "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 21117-57-00F58D7C "SOFTWARE\Microsoft\NetSh" in Source: 21117-81-00F53F80 "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00002392.00000000.141328.00F51000.00000020.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00002392.00000000.141328.00F51000.00000020.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007388.00000000.141164.03280000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1BE1F766-5536-11D1" in Source: 00000000-00007388.00000000.141164.03280000.00000004.mdmp 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" in Source: 00000000-00007388.00000000.141164.03280000.00000004.mdmp "[Software\Microsoft\Windows\CurrentVersion\Run]" in Source: 00000000-00007388.00000000.141164.05A60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007388.00000000.141164.05A60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007388.00000000.141164.05A60000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007388.00000000.141164.05A60000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrg" in Source: 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run]" in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp "KEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat" in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp "KEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp "KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp2f:T73a,Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7388:168:WilStaging_02" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7388:168:WilStaging_02" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7388:64:WilError_01" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "\Sessions\1\BaseNamedObjects\ef4ab10333351fde29c0e75b008795bc" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "Local\SM0:7388:168:WilStaging_02" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "ef4ab10333351fde29c0e75b008795bc" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "SM0:7388:64:WilError_01" Process 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe created mutex with name "SM0:7388:168:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2392:168:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2392:168:WilStaging_02" Process netsh.exe created mutex with name "Local\SM0:2392:168:WilStaging_02" Process netsh.exe created mutex with name "Global\RasPbFile" Process netsh.exe created mutex with name "SM0:2392:168:WilStaging_02"30:T420,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKey" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "Microsoft Corporation.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "Microsoft Corporation.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "Microsoft Corporation.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKey" in "Microsoft Corporation.exe"31:T976,Observed unmanaged function "FindWindowExA" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "FindWindowA" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "_SetWindowPos" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "_SendMessage" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "SystemParametersInfoA" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "SetWindowPos_" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "SendMessage_" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "SendMessage" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "mciSendStringA" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "SetWindowPos" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "SwapMouseButton" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "Beep" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "BlockInput_" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "BlockInput" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "ShowCursor" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "GetWindowThreadProcessId" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "GetForegroundWindow" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "GetClassNameA" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "SendMessageA" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "GetWindowText" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed unmanaged function "GetWindowTextLength" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170"32:T1b72,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "KERNEL32" at base 741c0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75700000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "ADVAPI32.DLL" at base 740f0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 723e0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "SHLWAPI.DLL" at base 74290000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75260000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "VERSION.DLL" at base 737f0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 71e30000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "USER32.DLL" at base 74cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "MSCOREE.DLL" at base 725c0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "NTDLL" at base 76f30000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "SHELL32.DLL" at base 758a0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "KERNEL32.DLL" at base 741c0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\7AA13700A6FCDCB57E6CB353E54D0AB9\MSCORLIB.NI.DLL" at base 71290000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "OLE32.DLL" at base 754b0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73400000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 71230000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\61E9A201160F8BAED9F7E00A4969992E\SYSTEM.NI.DLL" at base 70a80000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALBAS#\5F0A85C2A45C0FB0D1D12E010857A907\MICROSOFT.VISUALBASIC.NI.DLL" at base 708d0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "USER32" at base 74cb0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\D6163E1C32EBA738E42523885580DC48\SYSTEM.DRAWING.NI.DLL" at base 70740000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\860A4E79ADBD2EB86ADE9317E1CD9D2A\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6fb60000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "RPCRT4.DLL" at base 74bf0000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "SHFOLDER.DLL" at base 6fb10000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "NTDLL.DLL" at base 76f30000 "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74a00000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75700000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76cb0000 "netsh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76cb0000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76cb0000 "netsh.exe" loaded module "KERNEL32" at base 741c0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 75260000 "netsh.exe" loaded module "IFMON.DLL" at base 6fb00000 "netsh.exe" loaded module "MPRAPI.DLL" at base 6fa80000 "netsh.exe" loaded module "MSVCRT.DLL" at base 75390000 "netsh.exe" loaded module "RASMONTR.DLL" at base 6fa30000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 6f730000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 6f660000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 6f640000 "netsh.exe" loaded module "FWCFG.DLL" at base 6f500000 "netsh.exe" loaded module "HNETMON.DLL" at base 6f4f0000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 6f200000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 6f1e0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 6f170000 "netsh.exe" loaded module "RPCRT4.DLL" at base 74bf0000 "netsh.exe" loaded module "NSHWFP.DLL" at base 6efb0000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 6ef60000 "netsh.exe" loaded module "RPCNSH.DLL" at base 6ef20000 "netsh.exe" loaded module "WHHELPER.DLL" at base 6ef10000 "netsh.exe" loaded module "WLANCFG.DLL" at base 6ee20000 "netsh.exe" loaded module "WSHELPER.DLL" at base 6ed00000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 6ec50000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 73a90000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73400000 "netsh.exe" loaded module "WCMAPI.DLL" at base 6ec20000 "netsh.exe" loaded module "USERENV.DLL" at base 6f140000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 6ebb0000 "netsh.exe" loaded module "KERNEL32.DLL" at base 741c0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 756a0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 6eb70000 "netsh.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 6f6a0000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 76e9000033:T955,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Microsoft Corporation.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:T6a0,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007388-00000C2A-1198085234] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00007388-00000C2A-1198274518] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\7aa13700a6fcdcb57e6cb353e54d0ab9\mscorlib.ni.dll" [Source: 00000000-00007388-00000C2A-1198557016] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00007388-00000C2A-1198588842] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00007388-00000C2A-1198763941] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\61e9a201160f8baed9f7e00a4969992e\System.ni.dll" [Source: 00000000-00007388-00000C2A-1198802916] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5f0a85c2a45c0fb0d1d12e010857a907\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00007388-00000C2A-1198833098] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\d6163e1c32eba738e42523885580dc48\System.Drawing.ni.dll" [Source: 00000000-00007388-00000C2A-1198929751] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\860a4e79adbd2eb86ade9317e1cd9d2a\System.Windows.Forms.ni.dll" [Source: 00000000-00007388-00000C2A-1198979633] Observed system executable string:"@%WINDIR%\SysWOW64\FirewallControlPanel.dll,-12122" [Source: 00000000-00002392-00000BC1-1203941359]35:T7ae,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")36:Te67,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "16E030019F05B734A973A0FAFC0FB678D0EB2736CFD5159A7EA82EBF3C198170.EXE"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")37:T49c,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"38:Tacd,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\FLTLIB.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLE32.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\shfolder.dll" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\NETSH.EXE" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\netsh.exe" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "netsh.exe" "netsh.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "netsh.exe" trying to access non-existent file "C:\Windows\SysWOW64\MFC42LOC.DLL" "netsh.exe" trying to access non-existent file "C:\WINDOWS\system32\MFC42LOC.DLL" "netsh.exe" trying to access non-existent file "C:\Windows\SysWOW64\MFC42LOC.DLL.DLL"39:Ta8f,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\16E030019F05B734A973A0FAFC0FB678D0EB2736CFD5159A7EA82EBF3C198170.EXE.CONFIG" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\16E030019F05B734A973A0FAFC0FB678D0EB2736CFD5159A7EA82EBF3C198170.EXE.LOCAL" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe.Local\" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\FUSION.LOCALGAC" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe.config" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Windows\Globalization\EN-US.NLP" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\WINDOWS\Globalization\en-us.nlp" "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\APP"3a:Td28,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_ReceiveBufferSize" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_SendBufferSize" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendTimeout" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Connect" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Available" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Receive" in "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_ReceiveBufferSize" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "set_SendBufferSize" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_SendTimeout" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_ReceiveTimeout" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Connect" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Available" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Poll" in "Microsoft Corporation.exe" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "Microsoft Corporation.exe"3b:T591,"8.0.0.0" "1.0.0.0" "127.0.0.1" Potential IP "2.0.0.0" found in string "mscorlib,2.0.0.0,,b77a5c561934e089,x86" Potential IP "8.0.0.0" found in string "Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Xml,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86" Potential IP "2.0.0.0" found in string "System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL" Potential IP "2.0.0.0" found in string "System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "2.0.0.0" found in string "ystem.Drawing,2.0.0.0,,b03f5f7f11d50a3a" "192.168.0.2" "2.0.0.0" "27.0.0.1"3c:T11aa,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "11898015703,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11898957229,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11896710284,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11896616246,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11898774571,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11898819389,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11899586726,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11900348549,2084,104,,GetKeyState,user32.dll,"00:36:45.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11899490458,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11897232309,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11899635584,2084,103,,GetAsyncKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11899424299,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11898864915,2084,103,,GetAsyncKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "11899541378,2084,104,,GetKeyState,user32.dll,"00:36:45.671",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp") Found reference to API "57158191290,2084,104,,GetKeyState,user32.dll,"00:37:04.531",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "83919819898,2084,103,,GetAsyncKeyState,user32.dll,"00:37:15.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "83919018435,2084,104,,GetKeyState,user32.dll,"00:37:15.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "83919866158,2084,104,,GetKeyState,user32.dll,"00:37:15.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "83919637962,2084,104,,GetKeyState,user32.dll,"00:37:15.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "83919433715,2084,104,,GetKeyState,user32.dll,"00:37:15.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "83919682732,2084,104,,GetKeyState,user32.dll,"00:37:15.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "83919772058,2084,104,,GetKeyState,user32.dll,"00:37:15.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")3d:Teac,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007388) "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007388)3e:T9f0,Found string "ToBase64String" (Indicator: "base64"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "FromBase64String" (Indicator: "base64"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "GZipStream" (Indicator: "GzipStream"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") file/memory contains long string with (Indicator: "base64"; File: "Microsoft Corporation.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "Microsoft Corporation.exe") file/memory contains long string with (Indicator: "GzipStream"; File: "Microsoft Corporation.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "Microsoft Corporation.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "Microsoft Corporation.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "Microsoft Corporation.exe") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")3f:Ta0f,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")40:T646,Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; File: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002392.00000000.141328.00F69000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")41:Tbc5,Found string "[Back]" (Indicator: "[Back]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[shift]" (Indicator: "[shift]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[ctrl]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[Ctrl]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[alt]" (Indicator: "[alt]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[alt]" (Indicator: "[Alt]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[pause]" (Indicator: "[pause]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[left]" (Indicator: "[left]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[right]" (Indicator: "[right]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[down]" (Indicator: "[down]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[insert]" (Indicator: "[insert]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[Delete]" (Indicator: "[Delete]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00007388.00000000.141164.05A60000.00000004.mdmp")42:T869,Found string "Select * From AntiVirusProduct" (Indicator: "antivirusproduct"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found string "instance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp") Found string "_RELPATH FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "ance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "nce of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp") Found string "elect * From AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")43:T127c,Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "C:\\WINDOWS\\system32\\drivers\\etc\\hosts" (Indicator: "\drivers\"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005768.00000000.142727.00770000.00000004.mdmp, 00000000-00005952.00000000.142726.00B10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00005768.00000000.142727.00770000.00000004.mdmp, 00000000-00005952.00000000.142726.00B10000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "icrosoft windows 10 pro|c:\windows|\device\harddisk0\partition2" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp") Found string "BootDevice = "\\Device\\HarddiskVolume1"" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "BootDevice = "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp") Found string "Name = "Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition2";" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "SystemDevice = "\\Device\\HarddiskVolume2";" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition2"" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp"), Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp"), Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000001.143084.080D0000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp 00000000-00007388.00000002.145006.080E1000.00000004.mdmp"), file/memory contains long string with (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp"), Found string "em{BootDevice = '\\Device\\H" (Indicator: "\Device\"; Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp 00000000-00007388.00000002.145006.03280000.00000004.mdmp"), Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp"), Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")44:T436,Found reference to API "_SystemParametersInfo" (Indicator: "SystemParametersInfo"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "SystemParametersInfo" (Indicator: "SystemParametersInfo"; File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00002392.00000000.141328.00E40000.00000004.mdmp") Found reference to API "_SystemParametersInfo" (Indicator: "SystemParametersInfo"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp") Found reference to API "SystemParametersInfo" (Indicator: "SystemParametersInfo"; Source: "00000000-00007388.00000002.145006.00D42000.00000002.mdmp")45:Tac2,"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\NETSH.EXE"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")46:T4f4,Found string "winmgmts:\\.\root\SecurityCenter2" (Indicator: "winmgmts:"; in File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "winmgmts:\\\\.\\root\\SecurityCenter2" (Indicator: "winmgmts:"; in File: "16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170") Found string "\\%s\root\cimv2" (Indicator: "root\cimv2"; in File: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found string "\\%s\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002392.00000000.141328.00F51000.00000020.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp")47:T498,YARA signature "win_exe_njRAT" classified file "sample.bin" as "rat,njrat" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "sample.bin" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "MAL_Winnti_Sample_May18_1" classified file "sample.bin" as "winnti,umbrella" (Reference: https://401trg.pw/burning-umbrella/, Author: Florian Roth) YARA signature "win_exe_njRAT" classified file "Microsoft Corporation.exe.4089789698" as "rat,njrat" (Author: info@fidelissecurity.com) YARA signature "win_njrat_g0" classified file "Microsoft Corporation.exe.4089789698" as "njrat,rat" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "MAL_Winnti_Sample_May18_1" classified file "Microsoft Corporation.exe.4089789698" as "winnti,umbrella" (Reference: https://401trg.pw/burning-umbrella/, Author: Florian Roth) YARA signature "MALWARE_Win_NjRAT" matched file "sample.bin" as "Detects NjRAT / Bladabindi / NjRAT Golden" (Author: ditekSHen) YARA signature "MALWARE_Win_NjRAT" matched file "Microsoft Corporation.exe.4089789698" as "Detects NjRAT / Bladabindi / NjRAT Golden" (Author: ditekSHen)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790990602346,"unified_at":"2026-10-03T01:23:22.346Z","metadata":{"hashes":{"sha256":"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170","sha1":"6a56b12f075f8daaf354ca44810bec29e756c941","md5":"320f34b9a9f567e773d2a526daf749fa","sha512":"92c05e4d6c55b68810e55b918c5c017c5d772e9f85c65ec0f35b0b9b24345ba33e0e9d1fb0055df8cedb437ee55f6409e3ed16e6eca3a0a03be3831dc5531d50","ssdeep":"768:KY3/KpD7O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3hsGi:ZKBOx6baIa9RPj00ljEwzGi1dDRDUgS","ssdeep_chunks":["768:KY3/KpD","768:Y3/KpD7","768:3/KpD7O","768:/KpD7O/","768:KpD7O/p","768:pD7O/pB","768:D7O/pBc","768:7O/pBcx","768:O/pBcxY","768:/pBcxYs","768:pBcxYsb","768:BcxYsba","768:cxYsbae","768:xYsbae6","768:Ysbae6G","768:sbae6GI","768:bae6GIX","768:ae6GIXb","768:e6GIXb9","768:6GIXb9p","768:GIXb9pD","768:IXb9pDX","768:Xb9pDX2","768:b9pDX2b","768:9pDX2b9","768:pDX2b98","768:DX2b98P","768:X2b98PL","768:2b98PL0","768:b98PL0O","768:98PL0OX","768:8PL0OXL","768:PL0OXLe","768:L0OXLeu","768:0OXLeuX","768:OXLeuXx","768:XLeuXxr","768:LeuXxrj","768:euXxrjE","768:uXxrjEt","768:XxrjEtC","768:xrjEtCd","768:rjEtCdn","768:jEtCdnl","768:EtCdnl2","768:tCdnl2p","768:Cdnl2pi","768:dnl2pi1","768:nl2pi1R","768:l2pi1Rz","768:2pi1Rz4","768:pi1Rz4R","768:i1Rz4Rk","768:1Rz4Rk3","768:Rz4Rk3h","768:z4Rk3hs","768:4Rk3hsG","768:Rk3hsGi","1536:KY3/KpD","1536:Y3/KpD7","1536:3/KpD7O","1536:/KpD7O/","1536:KpD7O/p","1536:pD7O/pB","1536:D7O/pBc","1536:7O/pBcx","1536:O/pBcxY","1536:/pBcxYs","1536:pBcxYsb","1536:BcxYsba","1536:cxYsbae","1536:xYsbae6","1536:Ysbae6G","1536:sbae6GI","1536:bae6GIX","1536:ae6GIXb","1536:e6GIXb9","1536:6GIXb9p","1536:GIXb9pD","1536:IXb9pDX","1536:Xb9pDX2","1536:b9pDX2b","1536:9pDX2b9","1536:pDX2b98","1536:DX2b98P","1536:X2b98PL","1536:2b98PL0","1536:b98PL0O","1536:98PL0OX","1536:8PL0OXL","1536:PL0OXLe","1536:L0OXLeu","1536:0OXLeuX","1536:OXLeuXx","1536:XLeuXxr","1536:LeuXxrj","1536:euXxrjE","1536:uXxrjEt","1536:XxrjEtC","1536:xrjEtCd","1536:rjEtCdn","1536:jEtCdnl","1536:EtCdnl2","1536:tCdnl2p","1536:Cdnl2pi","1536:dnl2pi1","1536:nl2pi1R","1536:l2pi1Rz","1536:2pi1Rz4","1536:pi1Rz4R","1536:i1Rz4Rk","1536:1Rz4Rk3","1536:Rz4Rk3h","1536:z4Rk3hs","1536:4Rk3hsG","1536:Rk3hsGi","768:ZKBOx6b","768:KBOx6ba","768:BOx6baI","768:Ox6baIa","768:x6baIa9","768:6baIa9R","768:baIa9RP","768:aIa9RPj","768:Ia9RPj0","768:a9RPj00","768:9RPj00l","768:RPj00lj","768:Pj00ljE","768:j00ljEw","768:00ljEwz","768:0ljEwzG","768:ljEwzGi","768:jEwzGi1","768:EwzGi1d","768:wzGi1dD","768:zGi1dDR","768:Gi1dDRD","768:i1dDRDU","768:1dDRDUg","768:dDRDUgS"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-92647880842270273","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":95232,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1715950827000,"last_seen":1756189278000,"last_multi_scan":1756189278000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","agent","targetedcrimeware","loader","piccoload","targeted","criminal","asyncrat","bladabindi","modular","rat","backdoor","njrat","meterpreter","darkcomet","informationstealer","deploymentframework","metasploit","quasar","credentialharvesting","opensource","exploit","ransomware","downloader","winnti","umbrella","evasive"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":181,"suspicious_count":7,"malicious_count":7,"total":195},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Bladabindi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.Bladabindi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.MSIL.Krypt.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Generic-9795615-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.MSIL.Krypt.3 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Autorun.Spy.Agent.R worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Autorun.Spy.Agent.R.zfuv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Bladabindi.e","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"EmailWorm ( 00555f371 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"FE_Backdoor_MSIL_NJRAT_1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrjGen.dkmeat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/ILAgent-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.DN-NjRat.95232.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.BVX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MulDrop7.DOQR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Bladabindi.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_45.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.AutoRun.Win32.354785","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL.Krypt.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"informative","value":"Detects NETSH process execution"},{"type":"informative","value":"Found registry location string related to firewall policy"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to collect clipboard information (Dotnet)"},{"type":"suspicious","value":"YARA signature match – Special key logging"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to obtain MAC address in .NET file"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found registry location string related to BIOS"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve network adapter information (.NET)"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"malicious","value":"Contains ability to capture the screen"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"Microsoft Corporation.exe\")\n Found string \"GZipStream\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"System.IO.Compression.GZipStream\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"Microsoft Corporation.exe\")\n file/memory contains long string with (Indicator: \"MD5CryptoServiceProvider\"; File: \"Microsoft Corporation.exe\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"System.Reflection.Load\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - winmgmts:\\\\.\\root\\SecurityCenter2; Source: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")\n Found string - inmgmts:\\\\.\\root\\SecurityCenter2; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Microsoft Corporation.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"Microsoft Corporation.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Able to decode string content at runtime (.NET)\n Matched sigs: Contains ability to perform crypto operations\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"Microsoft Corporation.exe\" at offset 2844; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 2844; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002392-00000C2B-1202890470\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed dotnet function \"GetFiles\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed dotnet function \"GetLogicalDrives\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed dotnet function \"GetDirectories\" in \"Microsoft Corporation.exe\"\n Observed dotnet function \"GetFiles\" in \"Microsoft Corporation.exe\"\n Observed dotnet function \"GetLogicalDrives\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"Microsoft Corporation.exe\")\n Found string \"CredUIParseUserNameW\" (Source: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00005768.00000000.142727.00770000.00000004.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found string \"IOSVersion\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found string \"GetDrives\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002392-00000C2B-1202890470\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found string \"KEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007388-00000C2B-1198383157\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007388-00000C2B-1198384096\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")\n Found reference to API \"|GetLocaleInfo|L\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00002392.00000000.141328.00E40000.00000004.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00002392.00000000.141328.00E40000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007388)\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"IsWow64Process\" with parameter \"7388\" - (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"GetWindowTextA\" (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"GetActiveWindow\" (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007388)\n \"netsh.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007388)\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"System.IO.Directory::GetLogicalDrives() at 320f34b9a9f567e773d2a526daf749fa-6000057-Fransesco~Ind\n System.IO.Directory::GetLogicalDrives() at 320f34b9a9f567e773d2a526daf749fa-600005a-Fransesco~INS\n System.IO.Directory::GetLogicalDrives() at 320f34b9a9f567e773d2a526daf749fa-600008f-Usb1~infect","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"SetEnvironmentVariable\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"GetEnvironmentVariable\" in \"Microsoft Corporation.exe\"\n Observed function \"SetEnvironmentVariable\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_MachineName\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"get_UserName\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"get_SystemDirectory\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"get_OSVersion\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"get_MachineName\" in \"Microsoft Corporation.exe\"\n Observed function \"get_UserName\" in \"Microsoft Corporation.exe\"\n Observed function \"get_SystemDirectory\" in \"Microsoft Corporation.exe\"\n Observed function \"get_OSVersion\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set cdaudio door open\" (Indicator: \"set \"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found string \"set cdaudio door closed\" (Indicator: \"set \"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"IPGlobalProperties\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"TcpConnectionInformation\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"IPGlobalProperties\" in \"Microsoft Corporation.exe\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"TcpConnectionInformation\" in \"Microsoft Corporation.exe\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\n Observed string: \"KEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to firewall policy","description":"Found string \"KEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile\" (Indicator: \"services\\sharedaccess\\parameters\\firewallpolicy\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.004","relevance":1,"id":"string-415","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"KEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00002392-00000C17-1203882214\n \"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00002392-00000C17-1204501677","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00002392-00000C17-1203882214\n \"netsh.exe\" queries volume information of \"C:\\\" at 00000000-00002392-00000C17-1204501677","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"_RELPATH FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format\" (SID: 2055385, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in file \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"CopyFileW\" to copy C:\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"CreateProcessW\" with parameter \"netsh firewall add allowedprogram \"C:\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" \"16e030019f05b734a973a\" - (UID: 00000000-00007388)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"3.68.171.119:13006\"\n \"3.66.38.117:13006\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"netsh.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * From AntiVirusProduct\" (Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170, Indicator: \"select * from antivirusproduct\")\n \"select * from Win32_OperatingSystem\" (Source: 21117-68-00F58EDD, Indicator: \"select * from win32_operatingsystem\")\n \"select * from Win32_OperatingSystem\" (Source: 00000000-00002392.00000000.141328.00F51000.00000020.mdmp, Indicator: \"select * from win32_operatingsystem\")\n \"select * from Win32_OperatingSystem\" (Source: 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"Microsoft Corporation.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"seShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c ping 0 -n 2 & del \\\"\" (Indicator: \"cmd.exe /c\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"Microsoft Corporation.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartTime\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"Process.Start\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"Process.get_StartTime\" in \"Microsoft Corporation.exe\"\n Observed function \"Process.Start\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2f","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"$30","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\ole32.dll\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Microsoft Corporation.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$31","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\7aa13700a6fcdcb57e6cb353e54d0ab9\\mscorlib.ni.dll\" at 71290000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 756A0000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 756A0000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72720000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74BF0000\n \"netsh.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74BF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" was detected as \".NET\" and name: \"Library\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Microsoft Corporation.exe\" was detected as \".NET\" and name: \"Library\"\n \"Microsoft Corporation.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"Microsoft Corporation.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * From AntiVirusProduct\" (Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170, Indicator: \"select * from antivirusproduct\")\n \"select * from Win32_OperatingSystem\" (Source: 21117-68-00F58EDD, Indicator: \"select * from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"netsh.exe\" touched \"HNetCfg.FwMgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{304CE942-6E39-40D8-943A-B913C40C9CD4}\")\n \"netsh.exe\" touched \"HNetCfg.FwAuthorizedApplication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{EC9846B3-2762-4A6B-A214-6ACB603462D2}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Microsoft Corporation.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" has an executable section named \".text\"\n \"Microsoft Corporation.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\netsh.exe\" [Source: 00000000-00007388-00000BC0-1199829576]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"netsh.exe\" (UID: 00000000-00002392) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"netsh.exe\" (UID: 00000000-00002392) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"6.tcp.eu.ngrok.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\\\16e030019f05b734a973a0faf ...\" (UID: 00000000-00002392)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\\\16e030019f05b734a973a0faf ...\" (UID: 00000000-00002392)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Microsoft Corporation.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"952\"\n \"BaseAddress\": \"011F51E8\"\n \"Buffer\": \"010FDED8\"\n \"NumberOfBytesToWrite\": \"00000004\"\n \"$name\": \"C:\\\\Windows\\\\SysWOW64\\\\netsh.exe\"}","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"netsh.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Microsoft Corporation.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 2 sections\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe]- [targetUID: 00000000-00007388]\n \"Microsoft Corporation.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]\n \"app\" has type \"Unicode text UTF-8 (with BOM) text with no line terminators\"- Location: [%APPDATA%\\app]- [targetUID: 00000000-00007388]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" queries basic process information of the \"C:\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (UID: 7388)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"netsh.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002392)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" reads file \"c:\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" reads file \"c:\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe:zone.identifier\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00007388.00000000.141164.05A60000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\\.\"; Source: \"00000000-00007388.00000000.141164.05A60000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\"; Source: \"00000000-00007388.00000000.141164.05A60000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\\SEE_MASK_NOZONECHECKS\"; Source: \"00000000-00007388.00000000.141164.05A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe:Zone.Identifier\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\app\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\microsoft corporation.exe\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\microsoft corporation.exe:zone.identifier\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" writes file \"%appdata%\\app\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" writes file \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\microsoft corporation.exe:zone.identifier\"\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" writes file \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\microsoft corporation.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; File: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve network adapter information (.NET)","description":"file/memory contains long string(File: \"Microsoft Corporation.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-941","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"Microsoft Corporation.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"Microsoft Corporation.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveTimeout\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"set_ReceiveTimeout\" in \"Microsoft Corporation.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Receive\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed namespace \"System.Net.NetworkInformation\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed namespace \"System.Net\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed namespace \"System.Net.Sockets\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" ENABLE\" (UID: 00000000-00002392)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"6.tcp.eu.ngrok.io\"\n Pattern match: \"microsoft.net/framework/v2.0.50727/\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \".tcp.eu.ngrok.io\"\n Heuristic match: \"p.eu.ngrok.io\"\n Heuristic match: \"grok.io\"\n Heuristic match: \"aoi.bo\"\n Heuristic match: \"cim_computersystem.name\"\n Heuristic match: \"system.name\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found string \":\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00007388\"\n YARA signature to detect medium entropy file process \"00000000-00002392\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00002392\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEB9D92772331195207374B50ABCEF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEE767487C6C1D26E4474B6C9D18EB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE767487C6C1D26E4474B6C9D18EB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"Microsoft Corporation.exe\")\n Found string \"GetProcessById\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netsh.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Keyboard\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"Microsoft Corporation.exe\"\n Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Keyboard\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to collect clipboard information (Dotnet)","description":"Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Clipboard\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Clipboard\" in \"Microsoft Corporation.exe\"\n Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1056.001","relevance":1,"id":"static-163","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00007388.00000000.141164.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"GetProcessById\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"get_ProcessName\" in \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\"\n Observed function \"GetProcessesByName\" in \"Microsoft Corporation.exe\"\n Observed function \"GetProcessById\" in \"Microsoft Corporation.exe\"\n Observed function \"get_ProcessName\" in \"Microsoft Corporation.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle failed\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found reference to API \"GetModuleHandle failed\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002392.00000000.141328.00F51000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"Win32API|System Information Functions|GetSystemDirectory\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007388.00000002.145006.00D42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007388.00000001.143084.080D0000.00000004.mdmp, 00000000-00007388.00000002.145006.080E1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00002392.00000000.141328.00E40000.00000004.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002392.00000000.141328.00E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\n \"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp\n \"KEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp\n \"oftware\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007388.00000002.145006.00D42000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$41","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$42","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007388-00000C2B-1198209087\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$43","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007388.00000001.143084.03280000.00000004.mdmp, 00000000-00007388.00000002.145006.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"CreateWellKnownSid\" (Indicator: \"CreateWellKnownSid\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown -l\" (Indicator: \"shutdown \") in Source: 6000057-Fransesco~Ind\n Observed string: \"Shutdown -r\" (Indicator: \"shutdown \") in Source: 6000057-Fransesco~Ind\n Observed string: \"Shutdown -s\" (Indicator: \"shutdown \") in Source: 6000057-Fransesco~Ind","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002392.00000000.141328.00F69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"netsh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Microsoft Corporation.exe\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe]- [targetUID: 00000000-00007388]\n Dropped file: \"app\" - Location: [%APPDATA%\\app]- [targetUID: 00000000-00007388]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Microsoft Corporation.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"/Explorer.exe\" (Indicator: \"explorer.exe\"; File: \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7388)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"22/26 Antivirus vendors marked sample as malicious (84% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Microsoft Corporation.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 2 sections\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe]- [targetUID: 00000000-00007388]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" wrote 29696 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Special key logging","description":"YARA signature for Special key logging process \"00000000-00007388\"\n YARA signature for Special key logging file \"sample.bin\"\n YARA signature for Special key logging file \"Microsoft Corporation.exe.4089789698\"","origin":"YARA Signature","mitre_attack_id":"T1056.001","relevance":1,"id":"yara-171","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$46","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"22/26 Antivirus vendors marked sample as malicious (84% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"22/26 Antivirus vendors marked dropped file \"Microsoft Corporation.exe\" as malicious (classified as \"Gen:Heur.MSIL.Krypt\" with 84% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\netsh.exe\" (Handle: 952)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 3.68.171.119 on port 13006\n TCP traffic to 3.66.38.117 on port 13006","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$47","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture the screen","description":"System.Drawing.Graphics::CopyFromScreen(System.Int32,System.Int32,System.Int32,System.Int32,System.Drawing.Size,System.Drawing.CopyPixelOperation) at 320f34b9a9f567e773d2a526daf749fa-6000041-Fransesco~CaptureDesktop\n System.Drawing.Graphics::CopyFromScreen(System.Int32,System.Int32,System.Int32,System.Int32,System.Drawing.Size,System.Drawing.CopyPixelOperation) at 320f34b9a9f567e773d2a526daf749fa-6000057-Fransesco~Ind","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":3,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"C:\\\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" ENABLE\" (UID: 00000000-00002392)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies firewall settings"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":122,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","agent","targetedcrimeware","loader","piccoload","targeted","criminal","asyncrat","bladabindi","modular","rat","backdoor","njrat","meterpreter","darkcomet","informationstealer","deploymentframework","metasploit","quasar","credentialharvesting","opensource","exploit","ransomware","downloader","winnti","umbrella","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"68ad525dc8c01fe343008040","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170","analysis_start_time":"2025-08-26T06:21:18+00:00","indicators_count":{"informative":181,"suspicious":43,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"3.68.171.119","port":13006,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"address":"3.66.38.117","port":13006,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}],"dns_resolutions":[{"domain":"6.tcp.eu.ngrok.io","address":"3.68.171.119","ttl":60,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ngrok.ac","registrar_name_servers":"ns-1654.awsdns-14.co.uk","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}],"processes":[{"pid":7388,"ppid":0,"name":"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe","command_line":"","sha256":"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170","normalized_path":"C:\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe","uid":"00000000-00007388","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2392,"ppid":7388,"name":"netsh.exe","command_line":"netsh firewall add allowedprogram \"C:\\16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" \"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170.exe\" ENABLE","sha256":"6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb","normalized_path":"%WINDIR%\\SysWOW64\\netsh.exe","parent_uid":"00000000-00007388","uid":"00000000-00002392"}],"all_imported_dlls":["version.dll","cfgmgr32.dll","profapi.dll","wcmapi.dll","p2pnetsh.dll","msvcrt.dll","user32.dll","fltLib.dll","FWPUCLNT.DLL","netiohlp.dll","System.Drawing.ni.dll","dot3cfg.dll","dot3api.dll","eappcfg.dll","whhelper.dll","msctf.dll","PeerDistSh.dll","nsi.dll","onex.dll","ucrtbase.dll","polstore.dll","winipsec.dll","shfolder.dll","ntmarta.dll","mprapi.dll","wow64win.dll","apphelp.dll","System.Windows.Forms.ni.dll","fwbase.dll","nshwfp.dll","bcryptprimitives.dll","oleaut32.dll","msvcr80.dll","atl.dll","dnsapi.dll","msvcp110_win.dll","sechost.dll","mscoreei.dll","cryptbase.dll","imm32.dll","ktmw32.dll","slc.dll","cryptsp.dll","System.ni.dll","activeds.dll","gpapi.dll","crypt32.dll","rmclient.dll","wow64.dll","kernel.appcore.dll","powrprof.dll","fwcfg.dll","httpapi.dll","advapi32.dll","mscorlib.ni.dll","bcrypt.dll","ncrypt.dll","nshipsec.dll","WiFiDisplay.dll","sppc.dll","KernelBase.dll","SHCore.dll","FirewallAPI.dll","dmcmnutils.dll","wow64cpu.dll","win32u.dll","ole32.dll","authfwcfg.dll","nshhttp.dll","kernel32.dll","shlwapi.dll","dhcpcsvc.dll","clbcatq.dll","Microsoft.VisualBasic.ni.dll","ifmon.dll","VxSSL32.dll","rpcrt4.dll","dwmapi.dll","rasmontr.dll","mfc42u.dll","fwpolicyiomgr.dll","wlanapi.dll","mscoree.dll","shell32.dll","mscorjit.dll","IPHLPAPI.DLL","rasapi32.dll","hnetmon.dll","msasn1.dll","P2P.dll","windows.storage.dll","edputil.dll","wlancfg.dll","wevtapi.dll","mprmsg.dll","eappprxy.dll","rpcnsh.dll","mswsock.dll","dhcpcmonitor.dll","ntasn1.dll","adsldpc.dll","ntdll.dll","winnsi.dll","msvcp_win.dll","userenv.dll","mdmregistration.dll","uxtheme.dll","rasman.dll","dhcpcsvc6.dll","winhttp.dll","netshell.dll","nlaapi.dll","Wldap32.dll","gdi32full.dll","sspicli.dll","devobj.dll","ws2_32.dll","gdi32.dll","wshelper.dll","combase.dll","mscorwks.dll","cabinet.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Microsoft Corporation.exe","sha256":"16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"app","sha256":"538b830838cbf62e6ce267b48e2eb165030686e5b6317f0b1e9205a3e08c73b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Microsoft Corporation.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"path":"%TEMP%\\FransescoPast.txt","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"path":"%APPDATA%\\app","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Microsoft Corporation.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7388:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7388:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7388:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ef4ab10333351fde29c0e75b008795bc","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Local\\SM0:7388:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"ef4ab10333351fde29c0e75b008795bc","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"SM0:7388:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"SM0:7388:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2392:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2392:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Local\\SM0:2392:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]},{"name":"SM0:2392:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68ad525dc8c01fe343008040"}]}]}},"report_ids":{"sandbox_job_ids":["68ad525dc8c01fe343008040"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSIL.Krypt.Generic Sample 16e030019f05… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 16e030019f05…. Malware family: MSIL.Krypt.Generic. Threat score 100/100. 23/27 AV engines flagged this file. 7 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL.Krypt.Generic Sample 16e030019f05… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 16e030019f05…. Malware family: MSIL.Krypt.Generic. Threat score 100/100. 23/27 AV engines flagged this file. 7 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/16e030019f05b734a973a0fafc0fb678d0eb2736cfd5159a7ea82ebf3c198170"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL.Krypt.Generic Sample 16e030019f05… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 16e030019f05…. Malware family: MSIL.Krypt.Generic. Threat score 100/100. 23/27 AV engines flagged this file. 7 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]