24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample 286fddf3ce6b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 286fddf3ce6b…. Malware family: Lazy.Generic. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9"],"about":{"@type":"SoftwareApplication","name":"66b286b03f960_hp-scanner.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":14,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9aa,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SLHDLNDFFQPSQLXHGHKOOINBRKI" (Indicator: "brk"; Source: "sample.bin"), Found reference to API "FUORKMJJMVLTBRKWXQXFDQPBETBIJCKYCCKOKHBPLMVICHLAKR" (Indicator: "brk"; Source: "sample.bin"), Found reference to API "ACXVKEYVZTMLCEPKYVLVKPFTPFLNNBSMKJALUMUDERMSLOHISIOTOPMKWDGFTLIXBABTEEQLBI" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "Link" (Indicator: "link"; Source: "sample.bin"), Found reference to API "LPUMYRXSHSHNYAJRUOOPGXYZZZGTXRXCYVVHWQADTXYEDIGGNJTXZKTOQVMYLDUPUEPDFBUDOLVIYUV" (Indicator: "dup"; Source: "sample.bin"), Found reference to API "ThreadSafeObjectProvider`1" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SecurityAttributes" (Indicator: "security"; Source: "sample.bin"), Found reference to API "BindingNavigatorDeleteItem.Image" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "&Open Archive... Ctrl+O" (Indicator: "open"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "F+ (+BRK" (Indicator: "brk"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=40" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=64" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=16" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=18" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=30" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=32" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "&Status bar" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "BindingNavigatorMoveFirstItem.Image" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "BindingNavigatorMovePreviousItem.Image" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=256" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "IndentedWriter" (Indicator: "write"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin")26:T62c,Assembly shows XOR instruction xor byte ptr [ecx] cl in Stream UID: 00000000-00003680-58786-1-0042B9A6 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00003680-58786-1-0042B9A6 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00003680-58786-1-0042B9A6 Assembly shows XOR instruction xor dword ptr [04120000h] eax in Stream UID: 00000000-00003680-58786-1-0042B9A6 Assembly shows XOR instruction xor byte ptr [ebx] dh in Stream UID: 00000000-00003680-58786-272-004133F0 Assembly shows XOR instruction xor al byte ptr [bp+si+0Eh] in Stream UID: 00000000-00003680-58786-272-004133F0 Assembly shows XOR instruction xor bh byte ptr [edi+7D000662h] in Stream UID: 00000000-00003680-58786-272-004133F0 Assembly shows XOR instruction xor bl dl in Stream UID: 00000000-00003680-58786-272-004133F0 Assembly shows XOR instruction xor ebp dword ptr [edx] in Stream UID: 00000000-00003680-58786-272-004133F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003680-58786-272-004133F0 Assembly shows XOR instruction xor eax 02020411h in Stream UID: 00000000-00003680-58786-302-0041692A Assembly shows XOR instruction xor byte ptr [eax] ch in Stream UID: 00000000-00003680-58786-557-00430012 Assembly shows XOR instruction xor al 5Bh in Stream UID: 00000000-00003680-58786-557-00430012 Assembly shows XOR instruction xor esp ebx in Stream UID: 00000000-00003680-58786-557-00430012 Assembly shows XOR instruction xor ch byte ptr [ebp-39h] in Stream UID: 00000000-00003680-58786-557-0043001227:T669,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption28:T171a,Found XOR loop in file "sample.bin" at offset 959246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1588757; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1615847; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1679977; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1680029; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1786819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1864433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2031201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2110465; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2129473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2179987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2231251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2258189; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2260813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2332104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2382185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2506845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2566914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2604933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2694932; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2761155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2932333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3136286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3152257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3186198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3217123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3364532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3364546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1477859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1505449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1528030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1682132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1761635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1813565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1899753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1912435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1950972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2011484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2159928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2163003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2177006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2188729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2243261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2281990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2285509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2482173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2698181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2853042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2858619; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2872609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2904681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2912631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3077075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3160226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3169127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 78386; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 257465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1484009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1616136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1677294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1873760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1882420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2088820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2232753; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2279264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2298026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2397744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2418972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2689597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2700779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2800833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2835425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2871209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2905505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3215910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3253208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3288370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3289970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3290498; code bytes = 803029:T125c,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000014000000000000000000000000000000000000000000000002000002500e2c001500001500000000000000000000000080000000000000009f5000cf480f2c000100000000000000020000000c000000e8b32c00e8b32c00e3b32c000000000000000000000028000000000160f624000000000080fc240095e11677706b2a00feffffff435c1a7750591a7794000000a0000000e2b32c00e0b32c009400000004f82400fdfe3077e4f024000100000080fc2400a2e0316e3a62973bfeffffff9cf724005c9c316e5c0c0000b0f724006f9c316e0000000000000000 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000330048ac330043ac3300000000000000000000002800000000014c93240000000000b0a0240095e11677706b2a00feffffff435c1a7750591a77aa000000b800000042ac330040ac3300d49424000c99240000000000000000000000000000000000000000000000000000000000000000001c5c197760d82d75ffffffff1700000084942400240000000300000074992400a09e24000c99240086000000b094240096ed1a776aac3300a06af07486000000d49424000c9924000000000086008800a06af074d4942400916cf0746aac3300a06af074a06af0744499240002020000 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004252) "MSBuild.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003680) "MSBuild.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003680)2a:T49c,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000010000000000480f2c000c00000ce5270000d0242d00488e2c00000000000000000000000000000000000000000000000000000000000000000006000006b5270000304e2c00c0a52c000000000000000000000000000000000000000000 (UID: 00000000-00004252) "MSBuild.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000350030002c002c004900730057006f00770036003400500072006f0063006500730073002c006b00650072006e0065006c00330032002e0064006c006c002c0022003200350032003a00300036003a00320036002e0030003600340022002c00520058003d0030002c00500058003d00 (UID: 00000000-00003680) "MSBuild.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f61a77e2741b77f42e9271e8a65800a0359271d2741b77dced2a0048515200b2f41a77c2741b77eced2a0000008b7100008b710000000048ed2a00f0000000f0008b710000000058ed2a0053000000ecee2a000000000001000000bced2a0040f51a770000000000000000a8ed2a00 (UID: 00000000-00003680)2b:T57f,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" queries volume information of "C:\286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" at 00000000-00004252-0000010C-2612628 "MSBuild.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" at 00000000-00003680-0000010C-916081 "MSBuild.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003680-0000010C-2628414 "MSBuild.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003680-0000010C-2635536 "MSBuild.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003680-0000010C-3121531 "MSBuild.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003680-0000010C-3127993 "MSBuild.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003680-0000010C-34114192c:T4321,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter mscorjit.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter clrjit.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004252) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003680) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003680)2d:Taed7,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004252) "MSBuild.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003680) "MSBuild.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003680)2e:Te47,Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "RtlZeroMemory"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "FindResource"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004252.00000001.80263.01D20000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004252.00000001.80263.04560000.00000004.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00004252.00000001.80263.04560000.00000004.mdmp")2f:T6b7,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004252.00000001.80263.00280000.00000004.mdmp30:T1173,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" failed to load missing module "mscorjit.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "MSBuild.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]31:Taf6,Observed unmanaged function "CreateEventW" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "SetEvent" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "CloseHandle" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "SearchPath" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "SetThreadErrorMode" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "SetErrorMode" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "WaitForMultipleObjects" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetSystemInfo" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetNativeSystemInfo" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetOEMCP" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetFileAttributesEx" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "FreeLibrary" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetProcAddress" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "LoadLibrary" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetRequestedRuntimeInfo" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetModuleFileName" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetStdHandle" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetFileType" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetCurrentDirectory" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "SetCurrentDirectory" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GetFullPathName" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "OpenProcess" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "NtQueryInformationProcess" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" Observed unmanaged function "GlobalMemoryStatusEx" in "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9"32:T922,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00004252.00000000.80007.01D20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004252.00000001.80263.00280000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00004252.00000001.80263.01D20000.00000004.mdmp33:T2603,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "VERSION.DLL" at base 744f0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70b00000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "KERNEL32" at base 772c0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64690000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "USER32.DLL" at base 76430000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "MSCOREE.DLL" at base 6b770000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "PSAPI.DLL" at base 772a0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "RPCRT4.DLL" at base 76df0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "KERNEL32.DLL" at base 772c0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63280000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "OLE32.DLL" at base 766a0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "CRYPTBASE.DLL" at base 74f50000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b30000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73b20000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6aae0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62820000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62000000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 64f40000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73140000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "ADVAPI32.DLL" at base 76850000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "SHELL32.DLL" at base 75790000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77130000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "PROFAPI.DLL" at base 75060000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "BCRYPT.DLL" at base 74b70000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "ADVAPI32" at base 76850000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "CRYPTSP.DLL" at base 74a60000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 747f0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "NTDLL.DLL" at base 77150000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "CLRJIT.DLL" at base 6aae0000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "NTDLL" at base 77150000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f00000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77130000 "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" loaded module "RPCRTREMOTE.DLL" at base 74ff0000 "MSBuild.exe" loaded module "VERSION.DLL" at base 744f0000 "MSBuild.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70b00000 "MSBuild.exe" loaded module "KERNEL32" at base 772c0000 "MSBuild.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64690000 "MSBuild.exe" loaded module "USER32.DLL" at base 76430000 "MSBuild.exe" loaded module "MSCOREE.DLL" at base 6b770000 "MSBuild.exe" loaded module "PSAPI.DLL" at base 772a0000 "MSBuild.exe" loaded module "RPCRT4.DLL" at base 76df0000 "MSBuild.exe" loaded module "KERNEL32.DLL" at base 772c0000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61e70000 "MSBuild.exe" loaded module "OLE32.DLL" at base 766a0000 "MSBuild.exe" loaded module "CRYPTBASE.DLL" at base 74f50000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b30000 "MSBuild.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73150000 "MSBuild.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6aa50000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63c30000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 64f80000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61000000 "MSBuild.exe" loaded module "ADVAPI32.DLL" at base 76850000 "MSBuild.exe" loaded module "UXTHEME.DLL" at base 73b30000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63410000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a3b0000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60880000 "MSBuild.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72330000 "MSBuild.exe" loaded module "NTDLL.DLL" at base 77150000 "MSBuild.exe" loaded module "SHELL32.DLL" at base 75790000 "MSBuild.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77130000 "MSBuild.exe" loaded module "PROFAPI.DLL" at base 75060000 "MSBuild.exe" loaded module "BCRYPT.DLL" at base 74b70000 "MSBuild.exe" loaded module "CRYPTSP.DLL" at base 74a60000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 747f0000 "MSBuild.exe" loaded module "IMM32.DLL" at base 76c70000 "MSBuild.exe" loaded module "COMCTL32.DLL" at base 718b0000 "MSBuild.exe" loaded module "GDI32.DLL" at base 763e0000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 60460000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f820000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e430000 "MSBuild.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a610000 "MSBuild.exe" loaded module "SHLWAPI.DLL" at base 76c10000 "MSBuild.exe" loaded module "DWRITE.DLL" at base 64e40000 "MSBuild.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 752d0000 "MSBuild.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 63280000 "MSBuild.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5e340000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e060000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5dd50000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6e2c0000 "MSBuild.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d640000 "MSBuild.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6be20000 "MSBuild.exe" loaded module "WS2_32.DLL" at base 76800000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74a20000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74580000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74a10000 "MSBuild.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 71ca000034:T4bd,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"35:Tffe,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004252-00000C2B-253087984] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004252-00000C2B-254450865] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004252-00000C2B-254614156] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004252-00000C2B-254946716] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004252-00000C2B-255027048] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004252-00000C2B-255200105] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004252-00000C2B-255603629] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004252-00000C2B-255702878] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004252-00000C2B-255808426] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00004252-00000C2B-255918508] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004252-00000C2B-256016752] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004252-00000C2B-256585969] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004252-00000C2B-257282495] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00004252-00000C2B-257612260] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004252-00000C2B-258456711] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004252-00000C2B-258548184] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004252-00000C2B-258637305] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004252-00000C2B-258801051] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll" [Source: 00000000-00003680-00000C2B-260961422] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003680-00000C2B-261861227] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003680-00000C2B-261908080] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003680-00000C2B-262037482] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003680-00000C2B-262120011] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003680-00000C2B-262148166] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003680-00000C2B-262467489]36:Taa5,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")37:Tf2c,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "286FDDF3CE6B929DA962C680FEBFFF82719828CECF2C16DF5A14CBFD1DFD27E9"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "")38:T507,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.v9921e851#\a891970b44db9e340c3ef3efa95b793c\microsoft.visualbasic.ni.dll.aux" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe"39:Tacd,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\FLTLIB.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\MSVCP140.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\VCRUNTIME140.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\ucrtbase.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll"3a:Tc66,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\FLTLIB.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\MSVCP140.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\ucrtbase.DLL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll"3b:T966,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe.config" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\hpscanApp2024\" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.INI" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\286FDDF3CE6B929DA962C680FEBFFF82719828CECF2C16DF5A14CBFD1DFD27E9.EXE.CONFIG" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\HPSCANAPP2024" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\286FDDF3CE6B929DA962C680FEBFFF82719828CECF2C16DF5A14CBFD1DFD27E9.INI" "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "MSBuild.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "MSBuild.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "MSBuild.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Chondres\" "MSBuild.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.INI" "MSBuild.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe.Local\"3c:Td22,"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\hpscanApp2024\* (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\* (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter a891970b44db9e340c3ef3efa95b793c (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter 0b2f69b43a576b9edcc807a30872bd91 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\*.* (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter 1033 (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter Accessibility.dll (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter AddInProcess.exe (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter AddInProcess.exe.config (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter AddInProcess32.exe (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter AddInProcess32.exe.config (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter AddInUtil.exe (UID: 00000000-00004252) "286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe" called "FindNextFileW" with parameter AddInUtil.exe.config (UID: 00000000-00004252)3d:T66e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp")3e:T598,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001732.00000000.137560.050C0000.00000004.mdmp, 00000000-00001732.00000000.137560.076C0000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001732.00000000.137560.050C0000.00000004.mdmp, 00000000-00001732.00000000.137560.076C0000.00000004.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp, 00000000-00001732.00000000.137560.71A11000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp")3f:Te75,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"Microsoft.VisualBasic Version=10.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 66b286b03f960_hp-scanner.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001732-00000C28-1150328994] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001732-00000C28-1150665223] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001732-00000C28-1150775300] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001732-00000C28-1150843787] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001732-00000C28-1151139420] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001732-00000C28-1151174210] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001732-00000C28-1151252720] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001732-00000C28-1151337799] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001732-00000C28-1151390930] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001732-00000C28-1151571435] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001732-00000C28-1151614416] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001732-00000C28-1151868274] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001732-00000C28-1152149187] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001732-00000C28-1152247252] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001732-00000C28-1152599266] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00001732-00000C28-1153001230] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001732-00000C28-1153119232] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001732-00000C28-1153994417] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001732-00000C28-1154024692] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001732-00000C28-1154058632] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001732-00000C28-1154214375]40:Tadb,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportare\policies\microsoft\windows" - Source: "00000000-00001732.00000000.137560.03360000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001732.00000000.137560.050C0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001732.00000000.137560.050C0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001732.00000000.137560.71A11000.00000020.mdmp")41:Taec,"66b286b03f960_hp-scanner.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001732) "66b286b03f960_hp-scanner.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001732)42:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001732.00000000.137560.03220000.00000004.mdmp")43:T92b,Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp, 00000000-00001732.00000000.137560.71A11000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp, 00000000-00001732.00000000.137560.71A11000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp, 00000000-00001732.00000000.137560.71A11000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001732.00000000.137560.71971000.00000020.mdmp, 00000000-00001732.00000000.137560.71A11000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001732.00000000.137560.71A11000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001732.00000000.137560.71A11000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001732.00000000.137560.71A25000.00000002.mdmp")44:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00001732.00000000.137560.71A01000.00000002.mdmp")45:T48f,"66b286b03f960_hp-scanner.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "66b286b03f960_hp-scanner.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "66b286b03f960_hp-scanner.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "66b286b03f960_hp-scanner.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "66b286b03f960_hp-scanner.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "66b286b03f960_hp-scanner.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "MSBuild.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "MSBuild.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "MSBuild.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "MSBuild.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "MSBuild.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "MSBuild.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config"46:T8bd,"66b286b03f960_hp-scanner.exe wrote PE header bytes ("4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000504500004c0103008b0bb5a70000000000000000e00002010b01300000ec020000d0010000000000a6b9020000200000002003000000400000200000000400000400000000000000040000000000000000200500000400000000000002004085000010000010000000001000001000000000000010000000000000000000000054b902004f00000000200300ccc9010000000000000000000000000000000000000005000c00000038b902001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002e746578740000008ce902000020000000ec020000040000000000000000000000000000200000602e72737263000000ccc901000020030000cc010000f00200000000000000000000000000400000402e72656c6f6300000c000000000005000004000000bc040000000000000000000000000040000042000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" which might be an injection preparation attempt ...47:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAB3iHfd2IiAAAAAAAAAAAAAd3d3eNiIiHWIAAAAAAAAAHd3d3d4j4iIiAAAAAAAAAB3R3VXd3iIiIgAAAAAAAAAR3d3d3dXd3iIAAAAAAAAAHd3d3d3d3d1dwAAAAAAAAB3iHd3eIiId3cAAAAAAAAAd4132NiP+IiIAAAAAAAAAH3dfd3YiIiIiAAAAAAAAAB93d3d2IiIiIgAAAAAAAAA3djd3YiIh3WIAAAAAAAAAN2IiIiIiIh1eAAAAAAAAADdiIiIiIiId3gAAAAAAAAA3YiIiIiI+Id4AAAAAAAAAN2IiIiIiP+HeAAAAAAAAADdiIiIiIj/h1gAAAAAAAAA3YiIiIiI/3dYAAAAAAAAAN2I2IiIiPh1WAAAAAAAAABd2I2IiIj4dXgAAAAAAAAAXdh9iIiI93eIAAAAAAAAAHeId4iIiIiIiAAAAAAAAAB3iHeIiIiIiIgAAAAAAAAAd3h3d4iIiIiIAAAAAAAAAHd4d3d4iIiIiAAAAAAAAAB3d3d3d4iIiIgAAAAAAAAAd3d3d3eIiIiIAAAAAAAAAHd3d3d3d4iIiAAAAAAAAAB3d3d3d3d4eIgAAAAAAAAAd3d3d3d3d3AAAAAAAAAAAHd3d3d3cAAAAAAAAAAAAAAHd3d3AAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAD+AAD//gAAP/4AAD+AAAA/AAAAPwAAAD+AAAA/AAAAP8AAAD/4AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAD//4AH///AP///8///w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790747163558,"unified_at":"2026-09-30T05:46:03.558Z","metadata":{"hashes":{"sha256":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","sha1":"782d7efec796dc1bbe911529d504e8fb76adca44","md5":"5fb3019941edcfa601638879bb313395","sha512":"9bb7be2be54e806a25a3635e7b446de74d6e26f2bac38e8337d92f3ee04764b7b2f2758a34b0a38e850b113aabf64201d9bb750ebe48a89ed5a6a6a313424658","ssdeep":"98304:QBXN9nEx+Hr+6uzvu/4w92HeDp+6QBezn:QBXN9x+lzWQw2el+6QBc","ssdeep_chunks":["98304:QBXN9nE","98304:BXN9nEx","98304:XN9nEx+","98304:N9nEx+H","98304:9nEx+Hr","98304:nEx+Hr+","98304:Ex+Hr+6","98304:x+Hr+6u","98304:+Hr+6uz","98304:Hr+6uzv","98304:r+6uzvu","98304:+6uzvu/","98304:6uzvu/4","98304:uzvu/4w","98304:zvu/4w9","98304:vu/4w92","98304:u/4w92H","98304:/4w92He","98304:4w92HeD","98304:w92HeDp","98304:92HeDp+","98304:2HeDp+6","98304:HeDp+6Q","98304:eDp+6QB","98304:Dp+6QBe","98304:p+6QBez","98304:+6QBezn","196608:QBXN9nE","196608:BXN9nEx","196608:XN9nEx+","196608:N9nEx+H","196608:9nEx+Hr","196608:nEx+Hr+","196608:Ex+Hr+6","196608:x+Hr+6u","196608:+Hr+6uz","196608:Hr+6uzv","196608:r+6uzvu","196608:+6uzvu/","196608:6uzvu/4","196608:uzvu/4w","196608:zvu/4w9","196608:vu/4w92","196608:u/4w92H","196608:/4w92He","196608:4w92HeD","196608:w92HeDp","196608:92HeDp+","196608:2HeDp+6","196608:HeDp+6Q","196608:eDp+6QB","196608:Dp+6QBe","196608:p+6QBez","196608:+6QBezn","98304:QBXN9x+","98304:BXN9x+l","98304:XN9x+lz","98304:N9x+lzW","98304:9x+lzWQ","98304:x+lzWQw","98304:+lzWQw2","98304:lzWQw2e","98304:zWQw2el","98304:WQw2el+","98304:Qw2el+6","98304:w2el+6Q","98304:2el+6QB","98304:el+6QBc"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"493752e0c2311b38b32bfcff17051792bc7ff98a"},"file_info":{"file_name":"66b286b03f960_hp-scanner.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3397632,"entropy":7.52,"compile_timestamp":"2024-08-06T15:58:34","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1723309797000,"last_seen":1787889232000,"last_multi_scan":1787889232000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":4,"import_count":0,"export_count":0,"embedded_file_count":7,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":3277204,"raw_size":3277312},{"name":".sdata","virtual_address":"0x324000","virtual_size":488,"raw_size":512},{"name":".rsrc","virtual_address":"0x326000","virtual_size":118012,"raw_size":118272},{"name":".reloc","virtual_address":"0x344000","virtual_size":12,"raw_size":512}],"section_names":[".text",".sdata",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","amadeystealer","loader","backdoor","redlinestealer","amadeyloader","criminal","informationstealer","downloader","exploit","msil","ransomware","spambot","tofsee","wanacrypt0r","wannacry","wcry","worm"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":3,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":216,"suspicious_count":17,"malicious_count":13,"total":246},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Injection","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.583363","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Malwarex-10033462-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.583363 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.ALTN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.mc!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ba32d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.WPLU-9119","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.HDA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4852126","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"RedLineStealer","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"RENAISSANCE SPIDER","sources":[{"report_type":"qsp","report_id":""}]},{"value":"HOOK SPIDER","sources":[{"report_type":"qsp","report_id":""}]},{"value":"BRAIN SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"suspicious","value":"Adjusts debug privileges"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Able to detect if debugger is present"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Defense Evasion","technique":"MSBuild","attack_id":"T1127.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1127/001","identifiers":[{"type":"suspicious","value":"Detected MSBuild process execution"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"},{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment devices"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid number of Rva and Size of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with low confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-18","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"EJLGWUUTLWLATCCSHLICAESUPPRHIYRMXJQLLUTYNJWRUSHQNYXBAAOA\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"TIPDKROKVWWNIUZEKQXGEMOCDPUMVKAVNGADCAESAHYZOGSBQMHSFIOGTNZUWCOK\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"aescryptoserviceprovider\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"98.18.08.3\", \"4.0.0.0\", \"98.18.8.3\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"v+\t(..us\", Heuristic match: \"hpscanapp2024.my\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"System.Security.Cryptography.AesCryptoServiceProvider\" (Indicator: \"AesCryptoServiceProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression.zipfile.dll\" (Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")\n Found string \"system.io.compression.dll\" (Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")\n Found string \"clrcompression.dll\" (Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")\n Found string \"system.io.compression.filesystem.dll\" (Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetLastWin32Error\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ThrowExceptionForHR\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"MSBuild.exe\" called \"LoadResource with parameter {'hModule': '1692663808', 'hResInfo': '1693704568'}\" (UID: 00000000-00003680)\n \"MSBuild.exe\" called \"LoadResource with parameter {'hModule': '1692663808', 'hResInfo': '1693704552'}\" (UID: 00000000-00003680)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00004252.00000001.80263.00247000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.ReflectionOnlyLoad\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed function \"System.Reflection.ReflectionOnlyLoadFrom\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9 has big resource with name: \"WvouZxgxD\" size: \"1325072\" and abnormal entropy:\"7.992153092503546\"\n 286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9 has big resource with name: \"ZrZ8HNvl41OK8u6T24.33Od0NbfsR1ojqn3t3\" size: \"485566\" and abnormal entropy:\"7.999557588127123\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004252.00000001.80263.04560000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"NtQueryInformationProcess\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed function \"ToBase64String\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.04560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004252.00000000.80007.00280000.00000004.mdmp, 00000000-00004252.00000001.80263.00280000.00000004.mdmp\")\n Found string \"C:\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.51457","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$27","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004252-00000C2C-257277013\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"set_UserName\" (Source: \"00000000-00004252.00000001.80263.04560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004252-00000C2C-257277013\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003680-00000C2C-262384165\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004252-00000C2C-254611645\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004252-00000C2C-254612901\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004252)\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004252)\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"IsWow64Process\" with parameter \"4252\" - (UID: 00000000-00004252)\n \"MSBuild.exe\" called \"IsWow64Process\" with parameter \"3680\" - (UID: 00000000-00003680)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004252)\n \"MSBuild.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003680)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed function \"SetEnvironmentVariable\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed function \"GetEnvironmentVariable\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_OSVersion\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"GetProcAddress\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"\n Observed API \"LoadLibrary\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00004252.00000001.80263.04560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004252)\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004252)\n \"MSBuild.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003680)\n \"MSBuild.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003680)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.215.113.25:13686\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResource\" (Indicator: \"FindResource\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"set_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004252.00000001.80263.04560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetLastWriteTime\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartTime\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process MSBuild.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$31","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$32","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63280000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 61E70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74B70000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74B70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63EE0000\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64690000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64690000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76DF0000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76DF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002073326e@ADVAPI32.dll\"\n \"0e000f00e473326e@ADVAPI32.dll\"\n \"0e000f005074326e@ADVAPI32.dll\"\n \"11001200d47d326e@ADVAPI32.dll\"\n \"110012007c7e326e@ADVAPI32.dll\"\n \"12001300cc7e326e@ADVAPI32.dll\"\n \"12001300387f326e@ADVAPI32.dll\"\n \"14001500e4b7326e@ADVAPI32.dll\"\n \"1400150000b8326e@ADVAPI32.dll\"\n \"140015001cb8326e@ADVAPI32.dll\"\n \"1700180038b8326e@ADVAPI32.dll\"\n \"0d000e0054b8326e@ADVAPI32.dll\"\n \"1100120064b8326e@ADVAPI32.dll\"\n \"110012007cb8326e@ADVAPI32.dll\"\n \"0f001000ecb9326e@ADVAPI32.dll\"\n \"1400150038ba326e@ADVAPI32.dll\"\n \"1400150054ba326e@ADVAPI32.dll\"\n \"0c000d00a8ba326e@ADVAPI32.dll\"\n \"0c000d00b8ba326e@ADVAPI32.dll\"\n \"0e000f00c8ba326e@ADVAPI32.dll\"\n \"0e000f00dcba326e@ADVAPI32.dll\"\n \"0b000c00f0ba326e@ADVAPI32.dll\"\n \"180019008cbd326e@RPCRT4.dll\"\n \"13001400bcbd326e@RPCRT4.dll\"\n \"14001500d4bd326e@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" was detected as \".NET Reactor\" and name: \"Protector\"\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" was detected as \".NET\" and name: \"Library\"\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$34","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x320200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x320194\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" [Source: 00000000-00004252-00000C46-19314792504]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"MSBuild.exe\" (UID: 00000000-00003680) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"MSBuild.exe\" (UID: 00000000-00003680) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"MSBuild.exe\" (UID: 00000000-00003680)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"MSBuild.exe\" (UID: 00000000-00003680)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" connecting to \"\\ThemeApiPort\"\n \"MSBuild.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" queries basic process information of the \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\" (UID: 4252)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003680-00000C2C-264797231\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003680-00000C2C-264795283\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003680-00000C2C-264795283\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004252.00000000.80007.00F00000.00000002.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00004252\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource process \"00000000-00004252\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \":\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00004252.00000000.80007.00280000.00000004.mdmp, 00000000-00004252.00000001.80263.00280000.00000004.mdmp\")\n Found string \"indows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")\n Found string \"System.Runtime.Remoting\" (Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEEDE5302CCFA64CA594BB0BAEEAED]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004252.00000001.80263.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004252.00000000.80007.00280000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MSBuild.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004252.00000001.80263.00790000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00004252.00000000.80007.01D20000.00000004.mdmp, 00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\" (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004252.00000000.80007.00280000.00000004.mdmp, 00000000-00004252.00000001.80263.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004252.00000001.80263.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" opened \"\\Device\\KsecDD\"\n \"MSBuild.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Detected MSBuild process execution","description":"Process \"MSBuild.exe\" with commandline \"\" (UID: 00000000-00003680)","origin":"Monitored Target","mitre_attack_id":"T1127.001","relevance":5,"id":"target-300","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" at 00000000-00004252-00000105-4546682\n \"MSBuild.exe\" at 00000000-00003680-00000105-1587861","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" launched with commandline \"\" (UID: 00000000-00003680)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has section name .text with entropy \"7.546557439513069\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9\" has resource with unusual entropy \"RT_ICON:7.978309706305718\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" connects to 185.215.113.25 on port 13686 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00004252)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 777 instructions to a remote process\n Wrote 287 instructions to a remote process\n Wrote 88 instructions to a remote process\n Wrote 4 instructions to a remote process\n Wrote 177 instructions to a remote process\n Wrote 481 instructions to a remote process\n Wrote 40 instructions to a remote process\n Wrote 184 instructions to a remote process\n Wrote 3 instructions to a remote process\n Wrote 159 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 185.215.113.25 on port 13686","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"66b286b03f960_hp-scanner.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001732)\n \"66b286b03f960_hp-scanner.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001732)\n \"66b286b03f960_hp-scanner.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001732)\n \"66b286b03f960_hp-scanner.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001732)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetLastWin32Error\" in \"66b286b03f960_hp-scanner.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ThrowExceptionForHR\" in \"66b286b03f960_hp-scanner.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"66b286b03f960_hp-scanner.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"66b286b03f960_hp-scanner.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"66b286b03f960_hp-scanner.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001732.00000000.137560.03220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"66b286b03f960_hp-scanner.exe\"\n Observed function \"ToBase64String\" in \"66b286b03f960_hp-scanner.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001732.00000000.137560.03220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"66b286b03f960_hp-scanner.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001732.00000000.137560.71971000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001732.00000000.137560.71971000.00000020.mdmp, 00000000-00001732.00000000.137560.71A11000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001732.00000000.137560.71971000.00000020.mdmp, 00000000-00001732.00000000.137560.71A11000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"66b286b03f960_hp-scanner.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001732)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001732.00000000.137560.050C0000.00000004.mdmp, 00000000-00001732.00000000.137560.076C0000.00000004.mdmp, 00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"GetProcAddress\" in \"66b286b03f960_hp-scanner.exe\"\n Observed API \"LoadLibrary\" in \"66b286b03f960_hp-scanner.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"66b286b03f960_hp-scanner.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 71A60000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"66b286b03f960_hp-scanner.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"66b286b03f960_hp-scanner.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"66b286b03f960_hp-scanner.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66b286b03f960_hp-scanner.exe.log]- [targetUID: 00000000-00001732]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"66b286b03f960_hp-scanner.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\66b286b03f960_hp-scanner.exe.log\"\n \"66b286b03f960_hp-scanner.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\66b286b03f960_hp-scanner.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"66b286b03f960_hp-scanner.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66b286b03f960_hp-scanner.exe.log\"\n \"66b286b03f960_hp-scanner.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66b286b03f960_hp-scanner.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001732.00000000.137560.71971000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"66b286b03f960_hp-scanner.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RegNotifyChangeKeyValue\" (Indicator: \"RegNotifyChangeKeyValue\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001732.00000000.137560.71A11000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp, 00000000-00001732.00000000.137560.71A25000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"66b286b03f960_hp-scanner.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSBUILD.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001732.00000000.137560.71A01000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"66b286b03f960_hp-scanner.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66b286b03f960_hp-scanner.exe.log]- [targetUID: 00000000-00001732]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"66b286b03f960_hp-scanner.exe\" has section name .text with entropy \"7.54655743951\"\n \"66b286b03f960_hp-scanner.exe\" has section name .sdata with entropy \"6.6344582724\"\n \"66b286b03f960_hp-scanner.exe\" has section name .rsrc with entropy \"6.28648740094\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Microsoft net.tcp Connection Initialization Activity\" (SID: 2043233, Rev: 6, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"66b286b03f960_hp-scanner.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (PID: 638)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"66b286b03f960_hp-scanner.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1156)\n \"66b286b03f960_hp-scanner.exe\" wrote 00000400 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1156)\n \"66b286b03f960_hp-scanner.exe\" wrote 0002EC00 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1156)\n \"66b286b03f960_hp-scanner.exe\" wrote 0001CC00 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" (Handle: 1156)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002316.00000001.221997.01D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\VIJfon4hG9EG42kTrPRCuhBvcTDys5Nl0IxbLFbaF6GBesI06eSGXNoEGzN9YPWM9l9amN8kCmmDA3EHOLACoqBH8jKVqgbGyZI7Rl6xcLgv2AmT5BKhiU; Source: \"00000000-00000772-00000C55-2499932722\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"%TEMP%\\VBoxGuestAdditions\\*\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00000772-00000C2B-58641283340\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"%TEMP%\\VBoxGuestAdditions\\*\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00000772-00000C2B-58641283340\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"MSBuild.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\VIJfon4hG9EG42kTrPRCuhBvcTDys5Nl0IxbLFbaF6GBesI06eSGXNoEGzN9YPWM9l9amN8kCmmDA3EHOLACoqBH8jKVqgbGyZI7Rl6xcLgv2AmT5BKhiU\" - (UID: 00000000-00000772)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\VIJfon4hG9EG42kTrPRCuhBvcTDys5Nl0IxbLFbaF6GBesI06eSGXNoEGzN9YPWM9l9amN8kCmmDA3EHOLACoqBH8jKVqgbGyZI7Rl6xcLgv2AmT5BKhiU","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"MSBuild.exe\" called \"NtQueueApcThread\" (UID: 00000000-00000772)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"MSBuild.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1728122319\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"MSBuild.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1342246098\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"MSBuild.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"4a8b508\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00000772-00000C2B-58391059244\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00000772-00000C2B-58447460906\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"66b286b03f960_hp-scanner.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 2316)\n \"MSBuild.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 772)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"MSBuild.exe\" (Thread ID: 2888) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"66b286b03f960_hp-scanner.exe\" sleeping for \"1566804069\" milliseconds\n \"MSBuild.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"MSBuild.exe\" had access to \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (Type: \"FileHandle\")\n \"MSBuild.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\" (Type: \"FileHandle\")\n \"MSBuild.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\" (Type: \"FileHandle\")","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"$46","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"MSBuild.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Armory\\\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"MSBuild.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\K-Meleon\\\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]}],"intel_graph":{"map":{"Adversary:3f37a04b8b19f66de435857e436008e546080ab377197c71c0f42a54a50897d9":{"type":"Adversary","value":"RENAISSANCE SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548":{"type":"Adversary","value":"HOOK SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Adversary:b2cec45d88be8b578e0741dbce15e613dbc7e465833e88f331683b3a484e6158":{"type":"Adversary","value":"BRAIN SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"File:11ee4edb4ca9df15c4df1c24378c890302c3d5f1f1b7f69f23002c1d9fe288b9":{"type":"File","value":"11ee4edb4ca9df15c4df1c24378c890302c3d5f1f1b7f69f23002c1d9fe288b9","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat RedLineStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:239fff19be6c8cf0b5906f95ed521a52f801e5d1ecbe00ffa69722efa24f707b":{"type":"File","value":"239fff19be6c8cf0b5906f95ed521a52f801e5d1ecbe00ffa69722efa24f707b","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat RedLineStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9":{"type":"File","value":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malicious dynamic behaviour","Detected malware C2 configuration","Detected relationship with a Threat RedLineStealer","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat RedLineStealer","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:69b022be726801532af492bdfb140890ae7c08ea7c10048245e140742d84180d":{"type":"File","value":"69b022be726801532af492bdfb140890ae7c08ea7c10048245e140742d84180d"},"File:8ddf88c16149e1dc0bf2772cd19489fbed3de54c75ed7c5e36ce1dd01c6a3dc8":{"type":"File","value":"8ddf88c16149e1dc0bf2772cd19489fbed3de54c75ed7c5e36ce1dd01c6a3dc8","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat RedLineStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e":{"type":"File","value":"f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat RedLineStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"data (from detonation buffer)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:f6d69e9f4d3b9e7674943e0b7d6d883fd62339387e766c160df506dfcd39f3cd":{"type":"File","value":"f6d69e9f4d3b9e7674943e0b7d6d883fd62339387e766c160df506dfcd39f3cd","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat RedLineStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"Ip:185.215.113.25":{"type":"Ip","value":"185.215.113.25"},"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3":{"type":"Threat","value":"RedLineStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat RedLineStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]}},"Url:d387881c165273975db8887b44546e1bd888ddcdfff2b54a13013e9ff6dab850":{"type":"Url","value":"net.tcp://185.215.113.25:13686/","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:f225695d7b508fca51a5c3413e1733dc78c0458d52431bc4089c20cdf494080a":{"type":"Url","value":"unspec://185.215.113.25:13686","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1542744025812927617","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malicious dynamic behaviour","Detected malware C2 configuration","Detected relationship with a Threat RedLineStealer","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat RedLineStealer","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]}},{"id":"1542744037938964076","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat","confirmed relationship with an Adversary BRAIN SPIDER","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary RENAISSANCE SPIDER"]}},{"id":"1542744022978886026","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:11ee4edb4ca9df15c4df1c24378c890302c3d5f1f1b7f69f23002c1d9fe288b9"},{"edge_kind":"is_threat","from_key":"File:11ee4edb4ca9df15c4df1c24378c890302c3d5f1f1b7f69f23002c1d9fe288b9","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886029","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:11ee4edb4ca9df15c4df1c24378c890302c3d5f1f1b7f69f23002c1d9fe288b9"},{"edge_kind":"contains_c2_config","from_key":"File:11ee4edb4ca9df15c4df1c24378c890302c3d5f1f1b7f69f23002c1d9fe288b9","to_key":"Url:f225695d7b508fca51a5c3413e1733dc78c0458d52431bc4089c20cdf494080a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886025","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:239fff19be6c8cf0b5906f95ed521a52f801e5d1ecbe00ffa69722efa24f707b"},{"edge_kind":"is_threat","from_key":"File:239fff19be6c8cf0b5906f95ed521a52f801e5d1ecbe00ffa69722efa24f707b","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886036","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:239fff19be6c8cf0b5906f95ed521a52f801e5d1ecbe00ffa69722efa24f707b"},{"edge_kind":"contains_c2_config","from_key":"File:239fff19be6c8cf0b5906f95ed521a52f801e5d1ecbe00ffa69722efa24f707b","to_key":"Url:d387881c165273975db8887b44546e1bd888ddcdfff2b54a13013e9ff6dab850"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886024","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:8ddf88c16149e1dc0bf2772cd19489fbed3de54c75ed7c5e36ce1dd01c6a3dc8"},{"edge_kind":"is_threat","from_key":"File:8ddf88c16149e1dc0bf2772cd19489fbed3de54c75ed7c5e36ce1dd01c6a3dc8","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886035","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:8ddf88c16149e1dc0bf2772cd19489fbed3de54c75ed7c5e36ce1dd01c6a3dc8"},{"edge_kind":"contains_c2_config","from_key":"File:8ddf88c16149e1dc0bf2772cd19489fbed3de54c75ed7c5e36ce1dd01c6a3dc8","to_key":"Url:d387881c165273975db8887b44546e1bd888ddcdfff2b54a13013e9ff6dab850"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886022","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"extracted","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e"},{"edge_kind":"is_threat","from_key":"File:f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886027","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"extracted","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e"},{"edge_kind":"contains_c2_config","from_key":"File:f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e","to_key":"Url:f225695d7b508fca51a5c3413e1733dc78c0458d52431bc4089c20cdf494080a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886023","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:f6d69e9f4d3b9e7674943e0b7d6d883fd62339387e766c160df506dfcd39f3cd"},{"edge_kind":"is_threat","from_key":"File:f6d69e9f4d3b9e7674943e0b7d6d883fd62339387e766c160df506dfcd39f3cd","to_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744022978886028","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"memory","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:f6d69e9f4d3b9e7674943e0b7d6d883fd62339387e766c160df506dfcd39f3cd"},{"edge_kind":"contains_c2_config","from_key":"File:f6d69e9f4d3b9e7674943e0b7d6d883fd62339387e766c160df506dfcd39f3cd","to_key":"Url:f225695d7b508fca51a5c3413e1733dc78c0458d52431bc4089c20cdf494080a"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542744028864608808","root":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3","edges":[{"edge_kind":"used_by","from_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3","to_key":"Adversary:3f37a04b8b19f66de435857e436008e546080ab377197c71c0f42a54a50897d9"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542744028864608807","root":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3","edges":[{"edge_kind":"used_by","from_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3","to_key":"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542744028864608806","root":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3","edges":[{"edge_kind":"used_by","from_key":"Threat:98bcaeab215e23f1c1edb4075194c4bb3c746557cad619d1e2ef892ed9de6ee3","to_key":"Adversary:b2cec45d88be8b578e0741dbce15e613dbc7e465833e88f331683b3a484e6158"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"contacted_ip","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"Ip:185.215.113.25"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","edges":[{"edge_kind":"extracted","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e"},{"edge_kind":"extracted","from_key":"File:286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","to_key":"File:69b022be726801532af492bdfb140890ae7c08ea7c10048245e140742d84180d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":141,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":2,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","amadeystealer","loader","backdoor","redlinestealer","amadeyloader","criminal","informationstealer","downloader","exploit","msil","ransomware","spambot","tofsee","wanacrypt0r","wannacry","wcry","worm"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a851f42f67461c24f0c4a36","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.MSIL","contacted_countries":["SYC"],"submit_name":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","analysis_start_time":"2026-08-19T03:13:08+00:00","indicators_count":{"informative":138,"suspicious":16,"malicious":6},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"67019f5fd6e8063e1e01d35a","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["PRT"],"submit_name":"66b286b03f960_hp-scanner.exe","analysis_start_time":"2024-10-05T20:19:43+00:00","indicators_count":{"informative":122,"suspicious":28,"malicious":10},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"66ff6163a45f08bdcc032d0b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["PRT"],"submit_name":"66b286b03f960_hp-scanner.exe","analysis_start_time":"2024-10-04T03:30:43+00:00","indicators_count":{"informative":164,"suspicious":17,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.215.113.25","port":13686,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]}],"dns_resolutions":null,"http_requests":null,"embedded_urls":[{"value":"unspec://185.215.113.25:13686","sources":[{"report_type":"qsp","report_id":""}]},{"value":"net.tcp://185.215.113.25:13686/","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}],"processes":[{"pid":4252,"ppid":0,"name":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe","command_line":"","sha256":"286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9","normalized_path":"C:\\286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9.exe","uid":"00000000-00004252","icon":"$47"},{"pid":3680,"ppid":4252,"name":"MSBuild.exe","command_line":"","sha256":"d94e9ea7dce3dd4760f48356f14a986ea1fc8f1c84864105bf815a32284296ab","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe","parent_uid":"00000000-00004252","uid":"00000000-00003680"}],"all_imported_dlls":["VxSSL32.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","cryptsp.dll","apphelp.dll","wpfgfx_v0400.dll","System.ServiceModel.dll","SMDiagnostics.ni.dll","lpk.dll","ole32.dll","System.Core.ni.dll","shell32.dll","RpcRtRemote.dll","mswsock.dll","diasymreader.dll","nlssorting.dll","msvcrt.dll","usp10.dll","imm32.dll","clrjit.dll","WindowsBase.ni.dll","msctf.dll","rsaenh.dll","System.IdentityModel.ni.dll","msvcp140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","nsi.dll","version.dll","clr.dll","ucrtbase_clr0400.dll","psapi.dll","System.Drawing.ni.dll","rpcrt4.dll","oleaut32.dll","api-ms-win-core-file-l1-2-0.dll","System.Configuration.ni.dll","PresentationFramework.ni.dll","PresentationNative_v0400.dll","System.ServiceModel.Internals.dll","System.Transactions.dll","api-ms-win-core-processthreads-l1-1-1.dll","sechost.dll","api-ms-win-core-localization-l1-2-0.dll","PresentationCore.ni.dll","mscoree.dll","ucrtbase.dll","api-ms-win-crt-string-l1-1-0.dll","mscorrc.dll","System.Windows.Forms.dll","wship6.dll","ntdll.dll","mscorlib.ni.dll","profapi.dll","System.Xml.ni.dll","vcruntime140_clr0400.dll","System.Runtime.Serialization.ni.dll","System.Transactions.ni.dll","advapi32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-time-l1-1-0.dll","cryptbase.dll","uxtheme.dll","Microsoft.VisualBasic.ni.dll","System.Windows.Forms.ni.dll","DWrite.dll","KernelBase.dll","shlwapi.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","ws2_32.dll","msvcp140_clr0400.dll","kernel32.dll","vcruntime140.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","bcrypt.dll","comctl32.dll","gdi32.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","user32.dll","WSHTCPIP.DLL","api-ms-win-crt-math-l1-1-0.dll","rpcss.dll","mscoreei.dll","fltLib.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","System.IdentityModel.dll","wmiutils.dll","wbemprox.dll","System.Drawing.dll","secur32.dll","System.Management.dll","webengine4.dll","powrprof.dll","slc.dll","sppc.dll","WMINet_Utils.dll","GdiPlus.dll","cfgmgr32.dll","WindowsCodecs.dll","windows.storage.dll","System.Web.dll","dpapi.dll","wow64.dll","gdi32full.dll","SMDiagnostics.dll","bcryptprimitives.dll","Microsoft.VisualBasic.dll","amsi.dll","gpapi.dll","wow64win.dll","kernel.appcore.dll","wintrust.dll","wbemsvc.dll","combase.dll","MpOAV.dll","clbcatq.dll","fastprox.dll","System.Security.dll","win32u.dll","msasn1.dll","MpClient.dll","wbemcomn.dll","wow64cpu.dll","sspicli.dll","SHCore.dll","wldp.dll","crypt32.dll","userenv.dll","System.Web.Extensions.dll","msvcp_win.dll","dwmapi.dll","Accessibility.dll","wbemcomn2.dll","aspnet_rc.dll","System.Management.ni.dll","ntdsapi.dll","System.Security.ni.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e","sha256":"f00f32f0beb8cef3528fa5074beba99485b19ececef1259508bcfda563624b8e","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"66b286b03f960_hp-scanner.exe.log","sha256":"69b022be726801532af492bdfb140890ae7c08ea7c10048245e140742d84180d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"},{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"},{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66b286b03f960_hp-scanner.exe.log","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67019f5fd6e8063e1e01d35a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a851f42f67461c24f0c4a36"}]},{"name":"SM0:1732:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"name":"Local\\SM0:1732:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]},{"name":"SM0:1732:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66ff6163a45f08bdcc032d0b"}]}]}},"report_ids":{"sandbox_job_ids":["6a851f42f67461c24f0c4a36","67019f5fd6e8063e1e01d35a","66ff6163a45f08bdcc032d0b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Lazy.Generic Sample 286fddf3ce6b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 286fddf3ce6b…. Malware family: Lazy.Generic. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample 286fddf3ce6b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 286fddf3ce6b…. Malware family: Lazy.Generic. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/286fddf3ce6b929da962c680febfff82719828cecf2c16df5a14cbfd1dfd27e9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample 286fddf3ce6b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 286fddf3ce6b…. Malware family: Lazy.Generic. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]