34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 73:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 29197842e2d3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 29197842e2d3…. Malware family: Trojan.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72"],"about":{"@type":"SoftwareApplication","name":"carrier.exe","applicationCategory":["peexe","executable"],"identifier":"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":24},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T92f,Found string "Set to Default" (Indicator: "set "; Source: "sample.bin"), Found string "Set rating 5 to selected files" (Indicator: "set "; Source: "sample.bin"), Found string "Set for all %s where left is %s and right is %s" (Indicator: "set "; Source: "sample.bin"), Found string "Set empty fields only" (Indicator: "set "; Source: "sample.bin"), Found string "Set for all %s where right is %s" (Indicator: "set "; Source: "sample.bin"), Found string "Set Auto Fields Immediately After Reading Image Data (this may result in images shown with changed status)" (Indicator: "set "; Source: "sample.bin"), Found string "Set position marker from focused image" (Indicator: "set "; Source: "sample.bin"), Found string "Set Marker from Focused Image" (Indicator: "set "; Source: "sample.bin"), Found string "Set Taken Date to all EXIF Dates" (Indicator: "set "; Source: "sample.bin"), Found string "Set GPS Date from Taken Date" (Indicator: "set "; Source: "sample.bin"), Found string "Set Last Used Sorting" (Indicator: "set "; Source: "sample.bin"), Found string "Set rating 2 to selected files" (Indicator: "set "; Source: "sample.bin"), Found string "Set for all %s where right is "%s" and left is %s" (Indicator: "set "; Source: "sample.bin"), Found string "Set File Date from Taken Date" (Indicator: "set "; Source: "sample.bin"), Found string "Set Current Values For All Selected Images" (Indicator: "set "; Source: "sample.bin"), Found string "Set rating 1 to selected files" (Indicator: "set "; Source: "sample.bin"), Found string "Set rating 4 to selected files" (Indicator: "set "; Source: "sample.bin"), Found string "Set Image Direction from Exif Track Direction" (Indicator: "set "; Source: "sample.bin"), Found string "Set for all %s" (Indicator: "set "; Source: "sample.bin"), Found string "Set rating 3 to selected files" (Indicator: "set "; Source: "sample.bin"), Found string "Set IPTC Creation Date from Taken Date (can be changed individually for each image)" (Indicator: "set "; Source: "sample.bin"), Found string "Set to Fixed Date" (Indicator: "set "; Source: "sample.bin"), Found string "Set color of selected tracks" (Indicator: "set "; Source: "sample.bin"), Found string "Set File Date from Taken Date (if available)" (Indicator: "set "; Source: "sample.bin"), Found string "Set Color" (Indicator: "set "; Source: "sample.bin")37:T65c,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp")38:T53e,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp")39:Tfa3,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974400'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13966944'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974416'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13966960'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974432'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13966976'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974448'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13966992'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974464'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13967008'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974496'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13967040'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974480'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13967024'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13974512'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13970608'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '13970624'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '1986527232', 'hResInfo': '36767216'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '1880555520', 'hResInfo': '1880563840'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '1665466370', 'hResInfo': '1665595248'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '1665466370', 'hResInfo': '1665556816'}" (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadResource with parameter {'hModule': '1645150210', 'hResInfo': '1645279104'}" (UID: 00000000-00001380)3a:T12b8,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "Win32Api::SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "Win32Api::GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "result == ((((DWORD )0x00000000L) ) + 0 ) && L"WaitForSingleObject failed"" (Indicator: "WaitForSingleObject"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "(BOOL)g_pfnGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CreateTimerQueueTimer(&m_hTimerQueueHandle, nullptr, PeriodicTimer::TimerFired, this, period, period, 0x00000000)" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp")3b:T872,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "FreeLibraryAnd" (Indicator: "FreeLibrary"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp")3c:T434,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "RegSetKeyValueW" (Indicator: "RegSetKeyValue"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp")3d:T4ca,Found reference to ".?AVSHA512@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001380.00000001.77591.70052000.00000004.mdmp") Found reference to ".?AV?$IteratedHashWithStaticTransform@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@$0EA@VSHA512@2@$0EA@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001380.00000001.77591.70052000.00000004.mdmp") Found reference to ".?AV?$ClonableImpl@VSHA512@CryptoPP@@V?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001380.00000001.77591.70052000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001380.00000001.77591.70052000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00001380.00000001.77591.70052000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00001380.00000001.77591.70052000.00000004.mdmp")3e:T99e,Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found api reference "CryptAcquireContextW(&hProv, 0, 0, 1, 0xF0000000)" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found api reference "CryptImportKey(hProv, pBlob, cbBlob, 0, 0, &hKey)" (Indicator: "CryptImportKey"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found api reference "CryptCreateHash(hProv, ((4 << 13) | (0) | 9), hKey, 0, &hHash)" (Indicator: "CryptCreateHash"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found api reference "CryptSetHashParam(hHash, 0x0005, pHmacInfo, 0)" (Indicator: "CryptSetHashParam"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found api reference "CryptHashData(hHash, pbBuffer, cbBuffer, 0)" (Indicator: "CryptHashData"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found api reference "CryptHashData(hHash, bHmacPadding, cbPadding, 0)" (Indicator: "CryptHashData"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found api reference "CryptGetHashParam(hHash, 0x0002, pHash, &dwHmacLen, 0)" (Indicator: "CryptGetHashParam"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp")3f:T50e,Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStringsA"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResourceA"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "Win32Api::GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "Win32Api::GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp")40:T483,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001380.00000003.80206.709DA000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp")41:T786,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "Win32Api::GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "Win32Api::GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp")42:T7a0,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "Win32Api::FindWindowW" (Indicator: "findwindow"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "Win32Api::PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp")43:T386e,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004000cc55cc0051264000880c2b00860000000300000000000000c8fd12002729400003000000e5524000ac4e607701000000a41f4100d8fd120000000000f80c3802d4340000280b3802e4fd12004926400008ff12007852400001000000f81f4100440038024c0000003400380208fe120049264000cc55cc005126400008ff1200785240008c4e40000000000030ff1200272940008c4e4000546e40002cff1200d3534600db534600d8b6c000370200001b0000000100e80000010001b0434000d34c4000000000000400000001000000d24c4000d74c40000000000000000000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b617778906a77020000000c023e0100003e0126007801010000000000000000000000000000001800000027006701010000000000000038e21200a2e04c6b8c6eaac0 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00d8922e00d3922e00000000000000000000002600000000017ce5120000000000e0f2120095e15d7774631900feffffff435c617750596177aa000000b8000000d2922e00d0922e0004e712003ceb1200000000000000000000000000000000000000000000000000e0170000000026001c5c607760d85875ffffffff17000000b4e612002400000003000000a4eb1200d0f012003ceb120086000000e0e6120096ed6177fa922e00a06a37758600000004e712003ceb12000000000086008800a06a377504e71200916c3775fa922e00a06a3775a06a377574eb120002020000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004000000000000000000008e01200000140008ce01200e72c5e760000400080008c020000000000d0a00700b08a074566000000401f0400401f046410030034fc02001c2800001c2800008e09000000e0980042ca5500ac4e607793795875ffffffff84e012000000000070e0120000100000040000000010000094e01200ebefd46f30318c0230308c02802b8c02302e8c020000000030318c029766d46f00000100802b8c0230318c0201000000010000000000000000000000b82e8c02302e8c02f0e01200c4aad46fb82e8c02daaad46f5c8bf3ed30318c02443b2a0000000000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000120050722c1f4a00000003000000bcdf1200c8df12002ce21200a2e04c6bac69aac0feffffff10e1120016bc4b6b50722c1f0300000044e0120010e1120020bc4b6b7e00000000001300f0d0d46f2fbc4b6b560000007e00000050722c1f03000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e000000000000000000000000000000000000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002a00a8620570f9596277a0000000e8bb2a00e8bb2a002d923687b2e8eb47856423e77e728cf3030000002b00000018020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004bc2a0001000100a8620570c8e01200c8e0120024596277000000006071057040e52d00000000002b000000f0e01200 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000d16f0000a7020000000004228c0280218c0200000000010000000000000000000080c0f01200f220d16f0000000080218c02e0f01200cd20d16f000000007e20d16f0000000080218c02000000000000a702f0f01200ec1fd16f383b2a00c01200002cf11200b41fd16fc012000000000000b91fd16f809af3edc0120000383b2a000000000000000000443b2a0004f11200d0f4120024c6007000000000b91fd16f791fd16fc01200000000000000000000511fd16fc0120000b86505700000000070f11200a95e2b710000a70280120000c0120000400000008012a702c0120000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff435c61775059617715000000200000000abf3e0108bf3e0130bc3e0115000000ee29617730bc3e01388e240211000000808e24020000000080ed120031c5ae73cced120052444849388e240208000000808e240200000000a0ed120031c5ae735c8e2402c7e8ae7346d087d752444849388e2402408e2402408e240274ed1200000000006cef120029c4b37354414449ea1f000028bc3e01408e2402000000010000000028bc3e015c8e2402bdc5ae730d00000028bc3e0118ee12002483b77321000000ea1f00005441444900000000000000008050aa73b983b77317200000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000ac70f5abe8ea1200e8ea12001e754a6b00000000c8bd2e0020f212004c020000000000000000000000000000c4ef12005ecb81764c02000000000000005d7f7620f212000e5d7f76b8ed1200dcaa8376010000000000000072000000ffffffffffffffff40eb120078020000000000002500000040eb12007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360001e7b7ab98eb12006d8224760421990404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff090099019e010000620b8176000000006872260000000000500000004c2499040200000000e62b00000000000100000800b42b0090762600380b8176cce912000200000080ea12003f085f760200000000e62b00000000000100001888fb5e7670ea1200c81c837646ec120095fb5e76a4eb120000e62b000000000000000000000000002ceb1200000026007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b5e6b7abecea12006d8224760421990404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036009defb7ab04e412006d822476a4349b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000007c7af5ab38e0120038e012001e754a6b00000000106a2e0070e712007402000000000000000000000000000014e512005ecb81767402000000000000005d7f7670e712000e5d7f7608e31200dcaa8376010000000000000076000000ffffffffffffffff90e0120078020000000000002500000090e012007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b1ecb7abe8e012006d822476cc389b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000009b04003b00000000260000000000e03a9b044ce012000464617738012600e06361770200000000e62b00000000000100000810df120000000001bcc76977c0c769770a0000004028000000002600b8389b04f83b0000ff07000000009904102c2f007f070000102c2f0038322600e53c0000fcdf120067e55e7700002600b8389b000000000000002600000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360065ecb7ab3ce012006d822476cc389b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000ac70f5abe8ea1200e8ea12001e754a6b00000000703c2b0020f212006c020000000000000000000000000000c4ef12005ecb81766c02000000000000005d7f7620f212000e5d7f76b8ed1200dcaa8376010000000000000072000000ffffffffffffffff40eb120078020000000000002500000040eb12007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360001e7b7ab98eb12006d822476f4ba9b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff09009901ac556077a1266277ffffffff50ea120064ea12000040000000002600e0ba9b040000100068ea1200dfc55e77ffffffff50ea120064ea120000c65e77e8ba9b0400002600e0ba9b04ff0700007f07000000c09b04c4002600e8ba9b0438322600e0ba9b0400500100acea1200d7c35e770000260050e10b002c012600a7e55e7700002600000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b5e6b7abecea12006d822476f4ba9b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036009defb7ab04e412006d82247644bd9b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000dc50f5abd8ca1200d8ca12001e754a6b0000000060c29a0410d212006c020000000000000000000000000000b4cf12005ecb81766c02000000000000005d7f7610d212000e5d7f76a8cd1200dcaa8376010000000000000076000000ffffffffffffffff30cb120078020000000000002500000030cb12007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011c7b7ab88cb12006d8224761cde9b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000026005059617716000000a000000000000000e0202f00586f260074702600483b9a04b8732600f0c29a04a8c9120000000000e4ca120095e15d774c6d1900feffffffff2b61779a2a617724cb12002ccb12000000000028cb12000000000000000000000000000000000000000000000000000300000000000000a000000000000000b8ca1200c9765875000026007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c5c6b7abdcca12006d8224761cde9b0404010000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600b0842e0008fd120095e15d7737004200a3006400e06361771664617700000000d8822e0001000000a8842e00f4de12000029617700000000e0e4120000000000a8842e003cdf12001c76587500002600000000003276587520a287abe0e412000000000000000000e0c69b04000000002cdf120008df1200e4c69b0408fd1200bd065a75240bcddefeffffff7b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600f9d3b7aba0df12006d8224766cbd9b0404010000 (UID: 00000000-00001380)44:Tbce,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000e4fe1200a3244000cc55cc00ab244000d8b6c00037020000c0724600a9453e7710000000d8b6c00037020000c0724600604340001e0000001e4740001e000000764740001e000000abf5460038ff12003d47400028ff1200081038022c204300000000010810380230ff1200bcfd4600 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b20310000443b2a00100000001c00000028e112002ce212007ac8007008000000ac4e607793795875ffffffff90e11200000000007ce112000010000004000000002000009ce11200bf795875ffffffff00009102000091020010000004000000d4e11200000013006ee9d46f00009102ff000000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100205061636b20310000443b2a00100000001c00000028e112002ce212007ac8007008000000ac4e607793795875ffffffff90e11200000000007ce112000010000004000000002000009ce11200bf795875ffffffff00009102000091020010000004000000d4e11200000013006ee9d46f (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100205061636b203100205061636b20310000443b2a00100000001c00000028e112002ce212007ac8007008000000ac4e607793795875ffffffff90e11200000000007ce112000010000004000000002000009ce11200bf795875ffffffff00009102000091020010000004000000d4e11200 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000370200009e000000bc4a380200000000d8b6c0002c01000037020000ccfe1200a3244000cc55cc00fe4c40007724400024ff1200a4244000ccfe1200d8b6c0003702000008fc5e00acc9cd002c010000d8b6c0003702000008fc5e0060434000a60000001e474000a600000060080000 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c471b74b0699c048c471b7400000000b0699c044cf71200086d61771881697700000000c8f7120000000000000000008cf7120095e15d779c601900feffffff6b2c62773119597502100000000000000000010060f71200c89f61778c471b740000000000000000 (UID: 00000000-00001380)45:T6fc,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp")46:T6b5,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "Win32Api::FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp")47:Tfee,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter Userenv.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter olepro32.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\EhStorShell.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\GROOVEEX.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\1033\GrooveIntlResource.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\imageres.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IconCodecService.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter Mpr.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00001380)48:T7877,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SetEntriesInAclA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CreateRemoteThreadEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHGetDataFromIDListW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter lstrcmpW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter lstrcpynW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CharLowerBuffW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CharUpperBuffW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindFirstChangeNotificationW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetCharABCWidthsW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetShortPathNameW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetNumberFormatW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter WritePrivateProfileStringW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetPrivateProfileStringW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter InsertMenuItemW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHFileOperationW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHBrowseForFolderW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetCurrentDirW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter PathMatchSpecW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHDoDragDrop (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHGetKnownFolderIDList (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsForUserW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsForUserA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter DeleteVolumeMountPointA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetVolumeNameForVolumeMountPointA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetVolumePathNameA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SetVolumeMountPointA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindFirstVolumeA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindNextVolumeA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindVolumeClose (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindFirstVolumeMountPointA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindNextVolumeMountPointA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindVolumeMountPointClose (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindFirstFileExA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OleIconToCursor (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OleCreateFontIndirect (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OleLoadPicture (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OleTranslateColor (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OleCreatePropertyFrame (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OleCreatePropertyFrameIndirect (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter WICCreateImagingFactory_Proxy (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EnumDateFormatsExEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHSetInstanceExplorer (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHSetThreadRef (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHGetThreadRef (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHCreateThread (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHCreateThreadRef (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SHReleaseThreadRef (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter WNetGetResourceInformationA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter WNetGetResourceInformationW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001380)49:T4b9,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp")4a:T504,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "Win32Api::ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "Win32Api::ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "NoRemove 'ShellExecuteHooks'" (Indicator: "ShellExecute"; Source: "00000000-00001380.00000002.79515.700A0000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp")4b:T7db,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "LockResource" (Indicator: "LockResource"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp")4c:T40c,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp")4d:T61d,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp")4e:T551,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "HRESULT_FROM_WIN32(GetLastError())" (Indicator: "GetLastError"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp")4f:T40e,Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "Win32Api::ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "Win32Api::GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "__crtGetShowWindowMode" (Indicator: "ShowWindow"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001380.00000003.80206.70A18000.00000002.mdmp")50:T4c2,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001380.00000001.77591.04990000.00000004.mdmp 00000000-00001380.00000003.80206.04990000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001380.00000001.77591.04990000.00000004.mdmp 00000000-00001380.00000002.79515.00260000.00000004.mdmp 00000000-00001380.00000003.80206.00260000.00000004.mdmp 00000000-00001380.00000003.80206.04990000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001380.00000003.80206.02AE0000.00000002.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001380.00000003.80206.02AE0000.00000002.mdmp51:T12a1,"REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Classes\CLSID\{bbacc218-34ea-4666-9d7a-c78f2274a524}\InProcServer32" in Source: 00000000-00001380.00000000.75668.00260000.00000004.mdmp "Software\Mic" in Source: 00000000-00001380.00000000.75668.00260000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00001380.00000000.75668.00260000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Classes\CLSID\{a0396a93-dc06-4aef-bee9-95ffccaef20e}\InProcServer32" in Source: 00000000-00001380.00000000.75668.00260000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00001380.00000001.77591.70A01000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00001380.00000001.77591.70A01000.00000020.mdmp "Software\Microsoft\Windows Live\Environment\Sync" in Source: 00000000-00001380.00000001.77591.70A01000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00001380.00000001.77591.70A01000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\EnableAutoTray" in Source: 00000000-00001380.00000001.77591.70A01000.00000020.mdmp "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing" in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Classes\CLSID\{bbacc218-34ea-4666-9d7a-c78f2274a524}\InProcServer32" in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp "Software\Mic" in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00001380.00000002.79515.70851000.00000020.mdmp "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00001380.00000003.80206.00260000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" in Source: 00000000-00001380.00000003.80206.00260000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001380.00000003.80206.00260000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing" in Source: 00000000-00001380.00000003.80206.00260000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Classes\CLSID\{bbacc218-34ea-4666-9d7a-c78f2274a524}\InProcServer32" in Source: 00000000-00001380.00000003.80206.00260000.00000004.mdmp "Software\Mic" in Source: 00000000-00001380.00000003.80206.00260000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00001380.00000003.80206.00260000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003572.00000000.76267.006B1000.00000020.mdmp52:T10c2,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741e0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "KERNEL32.DLL" at base 765a0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "DWMAPI.DLL" at base 73d60000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "ADVAPI32.DLL" at base 75c80000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "OLE32.DLL" at base 75a70000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "SHLWAPI.DLL" at base 76230000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "USERENV.DLL" at base 75530000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "OLEPRO32.DLL" at base 6c1f0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "CRYPTBASE.DLL" at base 753c0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "COMCTL32.DLL" at base 744d0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "WINDOWSCODECS.DLL" at base 73a90000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 777f0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "PROFAPI.DLL" at base 754d0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "APPHELP.DLL" at base 75370000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "CLBCATQ.DLL" at base 77480000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%LOCALAPPDATA%\MICROSOFT\ONEDRIVE\17.3.4604.0120\FILESYNCSHELL.DLL" at base 70a00000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 765a0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORSHELL.DLL" at base 70d40000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\GROOVEEX.DLL" at base 6fd10000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 70170000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\1033\GROOVEINTLRESOURCE.DLL" at base 6f4a0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 70900000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "MPR.DLL" at base 71cf0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "OLEAUT32.DLL" at base 773e0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74280000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "SHELL32.DLL" at base 76790000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "SETUPAPI.DLL" at base 758d0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "RPCRT4.DLL" at base 77510000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "PROPSYS.DLL" at base 74280000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "WINHTTP.DLL" at base 70ca0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "MSVCRT.DLL" at base 75bd0000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "GDIPLUS.DLL" at base 74040000 "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 7404000053:T815,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INPROCSERVER32") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INPROCSERVER32") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INPROCSERVER32") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INPROCSERVER32") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INPROCSERVER32") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "All Control Panel Items" (Path: "HKCU\CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}\SHELLFOLDER") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER")54:T50a,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,mov eax, 0xc0b6d0,call 0x407cc8,mov eax, dword ptr [0xcc48dc],mov eax, dword ptr [eax],call 0x514dc4,mov eax, dword ptr [0xcc48dc],mov eax, dword ptr [eax],mov edx, 0xc0c8f0,call 0x514868,mov ecx, dword ptr [0xcc4e9c],mov eax, dword ptr [0xcc48dc],mov eax, dword ptr [eax],mov edx, dword ptr [0xbd11a8],call 0x514de4,mov eax, dword ptr [0xcc48dc],mov eax, dword ptr [eax],call 0x514e78,call 0x405130,add byte ptr [eax], al," "DISMHOST.EXE.6A854633.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"55:Te54,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA")56:Tb4f,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")57:T1034,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "29197842E2D3209AC504F9D79C8839884BD2B85D8D31748E6878EB15C704CF72"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "5EF9EC44-FB87-4F51-AF4E-CED084013281"; Value: "") "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\ACCESSPROVIDERS"; Key: "MARTAEXTENSION"; Value: "")58:Tc0a,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\mpr.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\mpr.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\version.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\version.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\msimg32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\msimg32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe.Local\" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\wsock32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\wsock32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\winspool.drv" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\winspool.drv" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\oleacc.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\oleacc.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\winmm.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\winmm.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\avifil32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\avifil32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\MSACM32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\MSACM32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\MSVFW32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to touch file "C:\Windows\system32\MSVFW32.dll"59:Td3a,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\mpr.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\version.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\msimg32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\wsock32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\oleacc.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\winmm.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\avifil32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\MSACM32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\MSVFW32.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\OLEACCRC.DLL" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\FaultRep.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\ntmarta.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.ENU.DLL" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.EN.DLL" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\FLTLIB.DLL" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\MSVCP140.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\ucrtbase.DLL" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll"5a:T5e6,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe.Local\" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\winspool.drv" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.ENU" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.EN" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842E2D3209AC504F9D79C8839884BD2B85D8D31748E6878EB15C704CF72.EXE.LOCAL" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842E2D3209AC504F9D79C8839884BD2B85D8D31748E6878EB15C704CF72.ENU" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\29197842E2D3209AC504F9D79C8839884BD2B85D8D31748E6878EB15C704CF72.EN" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI"5b:T172a,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "s_session.m_hHandle = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "hConnection = ::WinHttpConnect( m_hHandle, pszServer, nPort, NULL)" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CWinHttpConnection::AutoDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "hHttpSession = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CWinHttpConnection::Reset" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies(m_ServerName, &m_proxyInfo)" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxiesCallback" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "CWinHttpConnection::DoProxyFailover" (Indicator: "WinHttpConnect"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp")5c:T4b6,Found string "MailAsSmtpServer" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "MailAsSmtpClient" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "SmtpServer" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "SmtpSsl" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "SmtpTls" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "SmtpPort" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "SmtpAccount" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "SmtpPassword" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "SMTP:" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found string "TSmtpU" (Indicator: "smtp"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72")5d:T13e0,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found reference to API "WinHttpTimeFromSystemTime" (Indicator: "WinHttpTimeFromSystemTime"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp")5e:T2707,Found URL "http://www.adobe.comc:\windows\system32\adobeadobe" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://www.hancomoffice.comc:\users\hapubws\appdata\local\temp\7zipsfx.000\install\c:\program" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://www.hancomoffice.com/1566-5192hancomc:\windows\installer\" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://java.comc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_151\oracle" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=286133c:\windows\microsoft.net\framework\v4.0.30319\setupcache\v4.8.03761\microsoft" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=91955c:\program" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://www.python.org/python" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "https://www.wireshark.orgwireshark" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "https://ask.wireshark.org/c:\program" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "https://www.wireshark.org/download.htmlthe" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "https://www.wireshark.orgdc:\windows\installer\" - Source: "00000000-00001380.00000000.75668.00260000.00000004.mdmp") Found URL "http://sqm.microsoft.com/sqm/windowslive/sqmserver.dllsync" - Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found URL "http://www.adobe.comc:\windows\system32\adobeadobe" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://www.hancomoffice.comc:\users\hapubws\appdata\local\temp\7zipsfx.000\install\c:\program" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://www.hancomoffice.com/1566-5192hancomc:\windows\installer\" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://java.comc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_151\oracle" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=286133c:\windows\microsoft.net\framework\v4.0.30319\setupcache\v4.8.03761\microsoft" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=91955c:\program" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://www.python.org/python" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "https://www.wireshark.orgwireshark" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "https://ask.wireshark.org/c:\program" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "https://www.wireshark.org/download.htmlthe" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "https://www.wireshark.orgdc:\windows\installer\" - Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp") Found URL "http://ssw.live.com/uploaddata.aspxsoftware\microsoft\windows" - Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found URL "https://sqm.microsoft.com/sqm/%s/manifests/sqm%d.bintestmanifesturldisablemanifestdownload%s/?partner=%shttps://copyuploadedfilestofoldersamplingintervalupload" - Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found URL "http:///default.htmtransfer-encoding:" - Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found URL "https://%s:%d%swlc-extended-statusauthdocumentnotfoundcontent-encodinggzipunknownmachineguid" - Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found URL "http://www.adobe.comc:\windows\system32\adobeadobe" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "http://www.hancomoffice.comc:\users\hapubws\appdata\local\temp\7zipsfx.000\install\c:\program" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "http://www.hancomoffice.com/1566-5192hancomc:\windows\installer\" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "http://java.comc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_151\oracle" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=286133c:\windows\microsoft.net\framework\v4.0.30319\setupcache\v4.8.03761\microsoft" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=91955c:\program" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "http://www.python.org/python" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "https://www.wireshark.orgwireshark" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "https://ask.wireshark.org/c:\program" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "https://www.wireshark.org/download.htmlthe" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found URL "https://www.wireshark.orgdc:\windows\installer\" - Source: "00000000-00001380.00000003.80206.00260000.00000004.mdmp")5f:T56a,Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDC" (Indicator: "GetDC"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72")60:Tc7d,Found registry query API: "RegQueryValueExA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegQueryInfoKeyA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegOpenKeyExW" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegEnumKeyExA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegEnumKeyA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegOpenKeyExA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegNotifyChangeKeyValue" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegQueryValueExW" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegEnumValueA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry query API: "RegOpenKeyExW" in "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry query API: "RegGetValueW" in "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00001380.00000001.77591.708B9000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00001380.00000001.77591.70A01000.00000020.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp" Found registry query API: "Win32Api::SHRegGetUSValueW" in "00000000-00001380.00000001.77591.70A01000.00000020.mdmp" Found registry query API: "Win32Api::SHRegGetBoolUSValueW" in "00000000-00001380.00000001.77591.70A01000.00000020.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001380.00000003.80206.70A18000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00001380.00000003.80206.70A18000.00000002.mdmp"61:T516,Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72")62:T473,Found reference to API "GetLogicalDriveStringsA" (Indicator: "GetLogicalDriveStrings"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "Win32Api::GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "Win32Api::GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp")63:T948,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "Win32Api::GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "getLookupAccountName" (Indicator: "LookupAccountName"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp")64:Te67,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\MICROS~3\Office14\*.* (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter 1033 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter 1036 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter 3082 (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACCDDS.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACCDDSF.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACCDDSLM.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter AccessWeb (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACCICONS.EXE (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACCVDT.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACCWIZ (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACCWIZ.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ACEDAO.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ADDINS (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ADVCMP.DIC (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ADVTEL.DIC (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ADVZIP.DIC (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter ASCIIENG.LNG (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter AUDIOSEARCHLTS.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter AUDIOSEARCHMAIN.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter AUDIOSEARCHSAPIFE.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter AUTHZAX.DLL (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter BCSAutogen.dll (UID: 00000000-00001380) "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe" called "FindNextFileW" with parameter BCSClient.Msg.dll (UID: 00000000-00001380)65:T6ff,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp")66:T9c7,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp")67:T1183,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp")68:T414,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "Win32Api::GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "(BOOL)g_pfnGetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp")69:T707,Found registry deletion API: "RegDeleteValueW" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry deletion API: "RegDeleteValueA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry deletion API: "RegDeleteKeyA" in file "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" Found registry deletion API: "RegDeleteValueW" in "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyTransactedW" in "00000000-00001380.00000001.77591.70A01000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00001380.00000001.77591.70A01000.00000020.mdmp" Found registry deletion API: "Win32Api::SHDeleteValueW" in "00000000-00001380.00000001.77591.70A01000.00000020.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00001380.00000003.80206.70A18000.00000002.mdmp" Found registry deletion API: "SHDeleteKeyW" in "00000000-00001380.00000003.80206.70A18000.00000002.mdmp" Found registry deletion API: "SHDeleteValueW" in "00000000-00001380.00000003.80206.70A18000.00000002.mdmp"6a:T5c2,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\38A952CF-57D0-4BC8-B578-39A68486068B\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00003572.00000000.76267.00320000.00000004.mdmp")6b:T798,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "aviEmptyRecycleaviDeleteFile" (Indicator: "DeleteFile"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "Win32Api::RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001380.00000001.77591.70A01000.00000020.mdmp") Found reference to API "?AllowedDeleteFileResult@ScenarioQosDelegatedSyncWrapper@QoS@@QAE_NJ@Z" (Indicator: "DeleteFile"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "?StartDeleteFile@ScenarioQosDelegatedSyncWrapper@QoS@@QAEXXZ" (Indicator: "DeleteFile"; Source: "00000000-00001380.00000002.79515.70851000.00000020.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp")6c:T1025,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "AddAce" (Indicator: "AddAce"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "CopySid" (Indicator: "CopySid"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp")6d:T467,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "__crtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.70771000.00000020.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001380.00000003.80206.00CC5000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001380.00000003.80206.70771000.00000020.mdmp")6e:T11d1,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A854633.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A854633.bin]6f:Te5c,Found string "GetLongPathNameA" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: KERNELBASE.DLL) Found string "RtlGetVersion" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: NTDLL.DLL) Found string "GetNativeSystemInfo" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: KERNEL32.DLL) Found string "ChangeWindowMessageFilterEx" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: USER32.DLL) Found string "ChangeWindowMessageFilter" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: USER32.DLL) Found string "GetCursorInfo" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: USER32.DLL) Found string "InitCommonControlsEx" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: COMCTL32.DLL) Found string "CreateToolhelp32Snapshot" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: KERNEL32.DLL) Found string "Thread32First" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: KERNEL32.DLL) Found string "Thread32Next" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: KERNEL32.DLL) Found string "NtQuerySystemInformation" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: NTDLL.DLL) Found string "SetEntriesInAclA" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: ADVAPI32.DLL) Found string "SHGetPathFromIDListW" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: SHELL32.DLL) Found string "ShellExecuteExW" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: SHELL32.DLL) Found string "InternetAttemptConnect" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WININET.DLL) Found string "WinHttpOpen" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpConnect" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpOpenRequest" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpAddRequestHeaders" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpSendRequest" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpGetIEProxyConfigForCurrentUser" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpGetProxyForUrl" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpSetOption" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpWriteData" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL) Found string "WinHttpReceiveResponse" (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72, API is part of module: WINHTTP.DLL)70:T736,"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "EHRH:7.998090866029629" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "MAD:7.999684924669396" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_BITMAP:7.366430644655509" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.66989488327134" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.055767988759117" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.098966029156839" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.321003369248425" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.256888224281923" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.11738232699464" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.539141725828205" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.16640286715705" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.257562070207824" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.425174241451544" "29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72" has resource with unusual entropy "RT_RCDATA:7.276177041814382"71:T6ac,RegCloseKey RegOpenKeyExW RegEnumKeyExA RegCreateKeyExW RegDeleteValueW RegDeleteValueA RegEnumKeyA RegDeleteKeyA GetUserNameW GetUserNameA RegCreateKeyExA SetSecurityDescriptorDacl RegOpenKeyExA OpenProcessToken GetThreadContext WriteProcessMemory GetFileAttributesA GetCommandLineA UnhandledExceptionFilter GetComputerNameW GetFileAttributesW FindNextFileA GetTickCount CreateFileA FindNextFileW LoadLibraryW VirtualProtect GetVersionExW WriteFile OpenFileMappingA GetSystemInfo GetFileSize LoadLibraryA ReadProcessMemory GetTempPathA GetStartupInfoA DeleteFileW CreateFileMappingA TerminateProcess GetTempPathW CreateFileMappingW GetDriveTypeA GetSystemDirectoryA GetComputerNameA GetCommandLineW OutputDebugStringW GetProcAddress GetTempFileNameA MapViewOfFile CreateDirectoryA GetModuleHandleA GetVersionExA LockResource CopyFileA CreateDirectoryW Sleep GetLogicalDrives OutputDebugStringA FindResourceA FindResourceW VirtualAlloc OpenProcess DeleteFileA CreateProcessW DeviceIoControl FindFirstFileA FindFirstFileW ExitThread CreateProcessA CreateFileW CreateThread LoadLibraryExA GetModuleFileNameA CopyFileW GetModuleFileNameW WNetOpenEnumA ShellExecuteA ShellExecuteW ShellExecuteExA SetWindowsHookExW FindWindowA GetClipboardData GetLastActivePopup GetWindowThreadProcessId SetWindowsHookExA FindWindowExA SetKeyboardState GetCursorPos GetUpdateRect InternetOpenA InternetConnectA InternetCloseHandle InternetQueryOptionA EnumPrintersA bind WSAStartup recv closesocket send sendto socket connect recvfrom GetSystemDirectoryW LoadLibraryExW GetModuleHandleExW FindResourceExW GetModuleHandleW72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4u7u7jwAAAAAAAAAAAACLuLi7iLu4AAAAAAAAAACIi4uIiIi4iIgAAAAAAAAIiLiIiId4uIiIgAAAAAAAiIi4iLuACIiIiIgAAAAACIiLu7u4gHd4iIiIgAAAAIiIiIu7u4B3d4u4iI8AAACIiIiLiIhwCHd3iPAPAAAIiIiIi4iIdEdER3h3fwAACIiIiIuIiExHB3B3N3fwAPiIiIu4iIgMQAd3AAd3hwCLu7u7uIiHTMAAAHAHdHcAiLiLu4iIgEzEB3B3BEdwAPiP+I+IiHTMxEiAd3d3dwCPeHeI+PcMzMxAR4h3d3gAj4h4iPiETMzMxH+Hd3iIAH+Id4f3dMzMzMRHi7iIuACHeHf3d0zMzMzMxHiIiIsA/4/4j/dMzMzMzMB4iIiIAIj/iLiATMzMzMzAeIiIjwAIiIuIh0zMzMzMwHiIiIAACIiLiIdMzMzMzESIiIiAAACIuLiHDMzMzMxHiIiIAAAA+IiLi3RMzMzEO4iIjwAAAAiIu7iHRMzEQHiIiIAAAAAA+Iu4iIRABHiIiIgAAAAAAAiI+IAHeIiIiIiAAAAAAAAAD/AACIf4iIiPAAAAAAAAAACIAIeH+IiPAAAAAAAAAAAAAACHB/iIAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////+AH//+AAf/+AAB//AAAP/gAAB/wAAAP4AAAB+AAADfAAAAHwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAADwAAAA+AAAAfgAAAH8AAAD/gAAB/8DAA//zwAf/+YAf//+Qf//////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793946377194,"unified_at":"2026-11-06T06:26:17.194Z","metadata":{"hashes":{"sha256":"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","sha1":"d830c559d05cd9684d94046f4475e802ce287463","md5":"3686d869af7276fa2b6d55d04bd69d0d","sha512":"438e87d837f0f000eaa8074c64865b8fb70c7bf2dc7046436092c73ce6ff4d867c014cb390414ff1acbdcc8c30458e1fdd855458538d6683a76b50d0cf5afb2a","ssdeep":"393216:/hI2sim6V8lXRa6sUbMY2skzbd16NI7jBr:PScTP6Nkr","ssdeep_chunks":["393216:/hI2sim","393216:hI2sim6","393216:I2sim6V","393216:2sim6V8","393216:sim6V8l","393216:im6V8lX","393216:m6V8lXR","393216:6V8lXRa","393216:V8lXRa6","393216:8lXRa6s","393216:lXRa6sU","393216:XRa6sUb","393216:Ra6sUbM","393216:a6sUbMY","393216:6sUbMY2","393216:sUbMY2s","393216:UbMY2sk","393216:bMY2skz","393216:MY2skzb","393216:Y2skzbd","393216:2skzbd1","393216:skzbd16","393216:kzbd16N","393216:zbd16NI","393216:bd16NI7","393216:d16NI7j","393216:16NI7jB","393216:6NI7jBr","786432:/hI2sim","786432:hI2sim6","786432:I2sim6V","786432:2sim6V8","786432:sim6V8l","786432:im6V8lX","786432:m6V8lXR","786432:6V8lXRa","786432:V8lXRa6","786432:8lXRa6s","786432:lXRa6sU","786432:XRa6sUb","786432:Ra6sUbM","786432:a6sUbMY","786432:6sUbMY2","786432:sUbMY2s","786432:UbMY2sk","786432:bMY2skz","786432:MY2skzb","786432:Y2skzbd","786432:2skzbd1","786432:skzbd16","786432:kzbd16N","786432:zbd16NI","786432:bd16NI7","786432:d16NI7j","786432:16NI7jB","786432:6NI7jBr","393216:PScTP6N","393216:ScTP6Nk","393216:cTP6Nkr"],"imphash":"c473d13c63b12479c033ee92a317c612","pehash":"ef15a3c00deb0653d171064bc76f11a2aef775de"},"file_info":{"file_name":"carrier.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":14320520,"entropy":7.12,"compile_timestamp":"1992-06-19T22:22:17","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1723561509000,"last_seen":1787889717000,"last_multi_scan":1787889717000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":9,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":"CODE","virtual_address":"0x1000","virtual_size":8435964,"raw_size":8436224},{"name":"DATA","virtual_address":"0x80d000","virtual_size":753400,"raw_size":753664},{"name":"BSS","virtual_address":"0x8c5000","virtual_size":101449},{"name":".idata","virtual_address":"0x8de000","virtual_size":23290,"raw_size":23552},{"name":".edata","virtual_address":"0x8e4000","virtual_size":80,"raw_size":512},{"name":".tls","virtual_address":"0x8e5000","virtual_size":664},{"name":".rdata","virtual_address":"0x8e6000","virtual_size":24,"raw_size":512},{"name":".reloc","virtual_address":"0x8e7000","virtual_size":420792,"raw_size":420864},{"name":".rsrc","virtual_address":"0x94e000","virtual_size":4673217,"raw_size":4673536}],"section_names":["CODE","DATA","BSS",".idata",".edata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","sectoprat","rat","hijackloaderpayload","criminal","informationstealer"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":3,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":95},"sandbox_signatures":{"informative_count":236,"suspicious_count":13,"malicious_count":3,"total":252},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Penguish","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.73838990","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.73838990 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Rugmi.ALU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Downloader.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!8279CF4F8D71B62B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 005b96581 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Penguish.Win32.524","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"HijackLoaderPayload","sources":[{"report_type":"qsp","report_id":""}]},{"value":"SectopRAT","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - Embedded PDF document"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"YARA signature match - MD5 algorithm"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Able to discover program location on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Contains ability to retrieve internet cache entries (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Embedded PDF document","description":"YARA signature for embedded PDF matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-33","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-112","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$36","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"hardware\\description\\system\\centralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin, Observed string: \"hardware\\description\\system\\centralProcessor\\\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"{CountryCode}_{City}_{Sublocation}_{TakenDate}\" (Indicator: \"countrycode\") in Source: sample.bin, \"countryCode\" (Indicator: \"countrycode\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-575","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\madshi\\madCollection\" in Source: sample.bin, \"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: sample.bin, \"Software\\Microsoft\\Windows\" in Source: sample.bin, \"hardware\\description\\system\\centralProcessor\\0\" in Source: sample.bin, \"Software\\Borland\\Locales\" in Source: sample.bin, \"Software\\madshi\\ContactForm\" in Source: sample.bin, \"Software\\Borland\\Delphi\\Locales\" in Source: sample.bin, \"hardware\\description\\system\\centralProcessor\\\" in Source: sample.bin, \"System\\CurrentControlSet\\Control\\Class\\\" in Source: sample.bin, \"System\\CurrentControlSet\\Services\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetLongPathNameA\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetNativeSystemInfo\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select all objects of image(Select an area of the image to zoom intoBSelect or resize an object (hold Alt to maintain the aspect ratio)3Select the camera or scanner to acquire images from\" (Source: sample.bin, Indicator: \"select all objects of image(select an area of the image to zoom intobselect or resize an object (hold alt to maintain the aspect ratio)3select the camera or scanner to acquire images from\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\".pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.geosetter.de/en\", Pattern match: \"http://www.w3.org/2001/xmlschema\", Heuristic match: \"upload/synchronize to zoomin.de\", Heuristic match: \".sgi, .rgba, .rgb, .bw\", Pattern match: \"www.zoomin.de\", Pattern match: \"http://www.w3.org/2001/xmlschema-instance\", Pattern match: \"http://www.geosetter.de\", Heuristic match: \"upload to zoomin.de\", Pattern match: \"http://www.geosetter.de/mantis/changelog_page.php\", Pattern match: \"http://www.geosetter.de/changes-de\", Heuristic match: \"upload and/or synchronize selected images to zoomin.de\", Pattern match: \"http://www.geosetter.de/en/changes-en\", Pattern match: \"http://www.google.com/kml/ext/2.2\", Pattern match: \"http://www.zoomin.de/hilfe/spezielle-funktionen/geosetter/\", Pattern match: \"http://www.geosetter.de/geosetter_beta.exe\", Pattern match: \"www.geosetter.de/geosetter_beta.exe\", Pattern match: \"http://www.w3.org/2000/xmlns/\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"tzt.0Die Operation wird bei Socket nicht unterst\" (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \"r Socket den falschen Typ.\" (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \"en des Socket kann weder gesendet noch empfangen werden.0Zu viele Referenzen; keine Verbindungen m\" (Indicator: \" socket \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.2.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Route\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"Keine Route zum Host.\" (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Incorrect authentification:\nPlease verify your user name and/or password.\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"base64Binary\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\vwin32; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"unknown compression method\" (Source: \"00000000-00001380.00000001.77591.00C0F000.00000004.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"FindResourceW\" with parameter \"789\" - (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"FindResourceW\" with parameter \"2\" - (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"FindResourceW\" with parameter \"3\" - (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"FindResourceW\" with parameter \"17\" - (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"FindResourceW\" with parameter \"1001\" - (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"FindResourceW\" with parameter \"2102\" - (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \":ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001380.00000001.77591.00C0F000.00000004.mdmp\")\n Found string \":ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001380.00000001.77591.00C0F000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001380.00000002.79515.70851000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001380.00000002.79515.70851000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\")\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" queried SystemProcessInformation at 00000000-00001380-00000105-1354332 [PID: 1380]\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" queried SystemProcessInformation at 00000000-00001380-00000105-1354519 [PID: 1380]\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" queried SystemProcessInformation at 00000000-00001380-00000105-9564005 [PID: 1380]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001380.00000000.75668.00260000.00000004.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - Compress data using CryptoPP library","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"DISMHOST.EXE.6A854633.bin\" at offset 76665; code bytes = 30d0\n Found XOR loop in file \"DISMHOST.EXE.6A854633.bin\" at offset 77648; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6A854633.bin\" at offset 77788; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6A854633.bin\" at offset 78978; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Source: \"00000000-00001380.00000000.75668.00260000.00000004.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to discover program location on disk (API string)","description":"Found program location discovery API: \"__p__pgmptr\" in \"00000000-00001380.00000003.80206.70771000.00000020.mdmp\"\n Found program location discovery API: \"__p__wpgmptr\" in \"00000000-00001380.00000003.80206.70771000.00000020.mdmp\"\n Found program location discovery API: \"_get_pgmptr\" in \"00000000-00001380.00000003.80206.70771000.00000020.mdmp\"\n Found program location discovery API: \"_get_wpgmptr\" in \"00000000-00001380.00000003.80206.70771000.00000020.mdmp\"\n Found program location discovery API: \"_pgmptr\" in \"00000000-00001380.00000003.80206.70771000.00000020.mdmp\"\n Found program location discovery API: \"_wpgmptr\" in \"00000000-00001380.00000003.80206.70771000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-905","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")\n Found string \"Null argument: pUserName\" (Source: \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp\")\n Found string \"pUserName != NULL\" (Source: \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp\")\n Found string \"Win32Api::GetUserNameW\" (Source: \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp\")\n Found string \"getUserNameResult\" (Source: \"00000000-00001380.00000002.79515.70851000.00000020.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found string \"?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ\" (Source: \"00000000-00001380.00000003.80206.70771000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00001380.00000000.75668.00260000.00000004.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.6A854633.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"IsWow64Process\" with parameter \"1380\" - (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$43","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$44","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001380.00000002.79515.70851000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"Win32Api::FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver una preliminar de su impresi\" (Indicator: \"ver \") in Source: 00000000-00001380.00000001.77591.02380000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"Win32Api::GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c46515af\" at 00000000-00001380-0000010C-10048062","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp, 00000000-00001380.00000002.79515.70851000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A854633.bin\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" loaded module \"%WINDIR%\\System32\\Faultrep.dll\" at 720F0000","origin":"Loaded Module","id":"module-1","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00001380)\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00001380)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$48","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp\")\n Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001380.00000002.79515.70C74000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModuleExW\" (Indicator: \"LoadModule\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" contains export function called \"madTraceProcess\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$50","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\madExceptSettingsMtx$564\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6A854633.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DISMHOST.EXE.6A854633.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"bug@madshi.net\"\n Pattern match: \"support@geosetter.de\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75800000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$52","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77510000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1800190068e8466b@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8466b@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f466b@ntdll.dll\"\n \"100011000c3c4300@advapi32.dll\"\n \"18001900bc2b4300@ntdll.dll\"\n \"0d000e005cf54000@ntdll.dll\"\n \"1500160020734d6b@advapi32.dll\"\n \"0e000f00e4734d6b@advapi32.dll\"\n \"0e000f0050744d6b@advapi32.dll\"\n \"11001200d47d4d6b@advapi32.dll\"\n \"110012007c7e4d6b@advapi32.dll\"\n \"12001300cc7e4d6b@advapi32.dll\"\n \"12001300387f4d6b@advapi32.dll\"\n \"14001500e4b74d6b@advapi32.dll\"\n \"1400150000b84d6b@advapi32.dll\"\n \"140015001cb84d6b@advapi32.dll\"\n \"1700180038b84d6b@advapi32.dll\"\n \"0d000e0054b84d6b@advapi32.dll\"\n \"1100120064b84d6b@advapi32.dll\"\n \"110012007cb84d6b@advapi32.dll\"\n \"0d000e0090904d6b@wininet.dll\"\n \"0d000e000c914d6b@wininet.dll\"\n \"100011004c914d6b@wininet.dll\"\n \"1000110004924d6b@wininet.dll\"\n \"10001100ccb84d6b@wininet.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" was detected as \"Turbo Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.6A854633.bin\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"DISMHOST.EXE.6A854633.bin\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$53","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6A854633.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has an executable section named \"CODE\"\n \"DISMHOST.EXE.6A854633.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"kernel32.dll\" : \"203\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]\n Observed large number of imported APIs from \"user32.dll\" : \"271\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has an writable section named \"DATA\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has an writable section named \"BSS\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has an writable section named \".idata\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has an writable section named \".tls\"\n \"DISMHOST.EXE.6A854633.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$54","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"CODE\" is \"0x80ba00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x475000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"CODE\" is \"0x80b8fc\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x474ec1\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$55","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00001380.00000000.75668.00260000.00000004.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00001380-00000C2B-187095736]\n Observed system executable string:\"%WINDIR%\\system32\\EhStorShell.dll\" [Source: 00000000-00001380-00000C2B-191366046]\n Observed system executable string:\"%WINDIR%\\system32\\imageres.dll\" [Source: 00000000-00001380-00000C2B-193337517]\n Observed system executable string:\"%WINDIR%\\system32\\IconCodecService.dll\" [Source: 00000000-00001380-00000C2B-193491722]\n Observed system executable string:\"%WINDIR%\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\\gdiplus.dll\" [Source: 00000000-00001380-00000C2B-195551313]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Certum Trusted Network CA 2, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL\" (SHA1: 8D:57:E2:B4:00:8B:BE:46:14:70:A6:9F:34:92:BC:5A:E3:62:A7:A9; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Certum Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL\" (SHA1: CF:7D:5F:6E:F5:60:82:81:CA:E4:21:AC:FC:99:AE:45:22:BA:A8:51; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6A854633.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c46515af\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"c46515af\" has type \"PNG image data 1520 x 1929 8-bit/color RGB non-interlaced\"- Location: [%TEMP%\\c46515af]- [targetUID: 00000000-00001380]\n \"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators\"- [targetUID: 00000000-00001380]\n \"DISMHOST.EXE.6A854633.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00001380]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\iconcache.db\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to retrieve information set for devices (API string)\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\c46515af\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" writes file \"%temp%\\c46515af\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResource\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"WNetGetResourceInformationA\" (Indicator: \"WNetGetResourceInformation\"; Source: \"00000000-00001380-00000C2C-194420188\")\n Found reference to API \"WNetGetResourceInformationW\" (Indicator: \"WNetGetResourceInformation\"; Source: \"00000000-00001380-00000C2C-194420262\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet cache entries (API string)","description":"Found reference to API \"FindNextUrlCacheEntryExA\" (Indicator: \"FindNextUrlCacheEntry\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"FindFirstUrlCacheEntryExA\" (Indicator: \"FindFirstUrlCacheEntry\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-321","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\"), Found string \"Content-Type: multipart/form-data; boundary=\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\"), Found string \"Content-Disposition: form-data; name=\"%hs\"; filename=\"%ls\"\"; Source: \"00000000-00001380.00000002.79515.70851000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"MailAsSmtpServer\" (Indicator: \"SmtpServer\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to \"MailAsSmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00001380.00000000.75668.00260000.00000004.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")\n Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00001380.00000000.75668.00260000.00000004.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Contains references to the retrieval of internet session handle (imports API)","description":"Found InternetQueryOptionA in import section (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72)","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-206","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"end a network resource enumeration\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]\n Observed import api \"WNetEnumResource\" which can \"continue an enumeration of network recls.sources\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]\n Observed import api \"WNetGetUniversalName\" which can \"take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]\n Observed import api \"WNetOpenEnum\" which can \"start an enumeration of network recls.sources or existing connections.\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function process \"00000000-00001380\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$64","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp\")\n Found reference to API \"getLookupAccountName\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001380.00000002.79515.70851000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.709DA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where do you want to move these files?\" (Indicator: \"where \"; Source: \"00000000-00001380.00000001.77591.02380000.00000004.mdmp\")\n Found string \"Where do you want to copy these files?\" (Indicator: \"where \"; Source: \"00000000-00001380.00000001.77591.02380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp\")\n Found reference to API \"Win32Api::GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001380.00000001.77591.70A01000.00000020.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001380.00000000.75668.7083A000.00000004.mdmp, 00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000002.79515.70C74000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\" (Indicator: \"{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\") in Source: 00000000-00001380.00000002.79515.00260000.00000004.mdmp\n 00000000-00001380.00000003.80206.00260000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$6e","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"LDAPCLIENTINTEGRITY\"; Value: \"\")\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEOLDHOSTRESOLUTIONORDER\"; Value: \"\")\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEHOSTNAMEASALIAS\"; Value: \"\")\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"IPV4LOOPBACKALTERNATIVE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,smss.exe,csrss.exe,svchost.exe,spoolsv.exe\" (Source: \"00000000-00001380.00000000.75668.00260000.00000004.mdmp, 00000000-00001380.00000002.79515.00260000.00000004.mdmp, 00000000-00001380.00000003.80206.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.00CC5000.00000004.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00001380.00000001.77591.708B9000.00000002.mdmp, 00000000-00001380.00000003.80206.70A18000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"\n \"DISMHOST.EXE.6A854633.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"CODE\" unusually large (8435964 bytes)\n possible junk padding\n Section \".edata\" has very low entropy (0.86)\n indicating potential NOP sled\n Section \".rdata\" has very low entropy (0.21)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72\" has section name .rsrc with entropy \"7.78013192847574\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\c46515af\" has high entropy 7.99809","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$70","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.6A854633.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: 00000000-00001380]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"74010202\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"420107d3\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"74010202\"\n \"cx\": \"0\"\n \"cy\": \"25\"}\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"420107d3\"\n \"cx\": \"52\"\n \"cy\": \"39\"}\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"11010854\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"f010852\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.madExcept\" with delete access\n \"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.6A854633.bin\" claimed CRC 14351557 while the actual is CRC 103114","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$71","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]}],"intel_graph":{"map":{"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72":{"type":"File","value":"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat HijackLoaderPayload","PE file has invalid certificate","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat SectopRAT"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4d462a2ab8dfb88843e601ef0a67e8376e64393bbced28dc5769b0b04456a295":{"type":"File","value":"4d462a2ab8dfb88843e601ef0a67e8376e64393bbced28dc5769b0b04456a295","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/vnd.ms-cab-compressed"},"File:6e13ea1317cb4f052ab6f681d72683fe256956341d9c0946f8ebbf31a63da7df":{"type":"File","value":"6e13ea1317cb4f052ab6f681d72683fe256956341d9c0946f8ebbf31a63da7df"},"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646":{"type":"File","value":"a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat HijackLoaderPayload","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat SectopRAT"]},"filetype":"PNG image data, 1520 x 1929, 8-bit/color RGB, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Threat:8db646fe64f7868316200f2ba5d26fd6e73d4c02e92db2c151d1f869f3a83307":{"type":"Threat","value":"SectopRAT","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:9e788c57e7d23abc1808c3490810b6112ba07d25977357f468f46ee03f9a3526":{"type":"Threat","value":"HijackLoaderPayload","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat"]}}},"chains":[{"id":"1542746058877281724","root":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat HijackLoaderPayload","PE file has invalid certificate","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat SectopRAT"]}},{"id":"1542746052996269873","root":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:4d462a2ab8dfb88843e601ef0a67e8376e64393bbced28dc5769b0b04456a295"}],"verdict":{"verdict":"unknown"}},{"id":"1542746066691270313","root":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat SectopRAT"]}},{"id":"1542746048497316813","root":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"Threat:8db646fe64f7868316200f2ba5d26fd6e73d4c02e92db2c151d1f869f3a83307"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542746065167742471","root":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"Threat:9e788c57e7d23abc1808c3490810b6112ba07d25977357f468f46ee03f9a3526"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat"]}},{"id":"1542746066695464618","root":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646"},{"edge_kind":"is_threat","from_key":"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646","to_key":"Threat:9e788c57e7d23abc1808c3490810b6112ba07d25977357f468f46ee03f9a3526"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542746063605366049","root":"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646","to_key":"Threat:8db646fe64f7868316200f2ba5d26fd6e73d4c02e92db2c151d1f869f3a83307"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","edges":[{"edge_kind":"extracted","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646"},{"edge_kind":"extracted","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:4d462a2ab8dfb88843e601ef0a67e8376e64393bbced28dc5769b0b04456a295"},{"edge_kind":"extracted","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646"},{"edge_kind":"extracted","from_key":"File:29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","to_key":"File:6e13ea1317cb4f052ab6f681d72683fe256956341d9c0946f8ebbf31a63da7df"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","sectoprat","rat","hijackloaderpayload","criminal","informationstealer"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6a8529f4ff0703c25800d30a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","analysis_start_time":"2026-08-19T03:58:46+00:00","indicators_count":{"informative":236,"suspicious":24,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}],"processes":[{"pid":1380,"ppid":0,"name":"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe","command_line":"","sha256":"29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72","normalized_path":"C:\\29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72.exe","uid":"00000000-00001380","icon":"$72"}],"all_imported_dlls":["usp10.dll","rpcrt4.dll","ole32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ntmarta.dll","api-ms-win-core-timezone-l1-1-0.dll","WindowsCodecs.dll","ntdll.dll","shell32.dll","winmm.dll","fltLib.dll","user32.dll","ws2_32.dll","Wldap32.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-time-l1-1-0.dll","EhStorShell.dll","setupapi.dll","msimg32.dll","wininet.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","shunimpl.dll","devobj.dll","lpk.dll","wsock32.dll","api-ms-win-crt-filesystem-l1-1-0.dll","psapi.dll","msvcp90.dll","gdi32.dll","advapi32.dll","profapi.dll","msvcp140.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","Telemetry.dll","api-ms-win-downlevel-version-l1-1-0.dll","webio.dll","cfgmgr32.dll","GrooveIntlResource.dll","IconCodecService.dll","msvcrt.dll","oleaut32.dll","mpr.dll","iertutil.dll","userenv.dll","Faultrep.dll","FileSyncShell.dll","xmllite.dll","version.dll","msctf.dll","rpcss.dll","clbcatq.dll","imageres.dll","sechost.dll","avifil32.dll","dwmapi.dll","propsys.dll","msvcr90.dll","ATL90.dll","shlwapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msacm32.dll","oleaccrc.dll","vcruntime140.dll","api-ms-win-crt-stdio-l1-1-0.dll","apphelp.dll","msvcp110.dll","kernel32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","comdlg32.dll","api-ms-win-crt-utility-l1-1-0.dll","msvcr110.dll","LoggingPlatform.dll","winhttp.dll","imm32.dll","oleacc.dll","msvfw32.dll","GdiPlus.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","uxtheme.dll","cabinet.dll","comctl32.dll","urlmon.dll","api-ms-win-crt-string-l1-1-0.dll","olepro32.dll","cryptbase.dll","GROOVEEX.DLL","VxSSL32.dll","ucrtbase.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","KernelBase.dll","normaliz.dll","nsi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646","sha256":"a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4d462a2ab8dfb88843e601ef0a67e8376e64393bbced28dc5769b0b04456a295","sha256":"4d462a2ab8dfb88843e601ef0a67e8376e64393bbced28dc5769b0b04456a295","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"DISMHOST.EXE.6A854633.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"name":"c46515af","sha256":"a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"name":"dism.log","sha256":"6e13ea1317cb4f052ab6f681d72683fe256956341d9c0946f8ebbf31a63da7df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]},{"path":"%TEMP%\\c46515af","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\madExceptSettingsMtx$564","sources":[{"report_type":"sandbox","report_id":"6a8529f4ff0703c25800d30a"}]}]}},"report_ids":{"sandbox_job_ids":["6a8529f4ff0703c25800d30a"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 29197842e2d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 29197842e2d3…. Malware family: Trojan.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 29197842e2d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 29197842e2d3…. Malware family: Trojan.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 29197842e2d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 29197842e2d3…. Malware family: Trojan.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]] 32:null