26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample 2a899ee00e6f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2a899ee00e6f…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/25 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a"],"about":{"@type":"SoftwareApplication","name":"Payment.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":12,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T51d,Found reference to API "SynchronizeWithVerticalRetrace" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "ReadByte" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Non-deterministic polynomial-time solution" (Indicator: "time"; Source: "sample.bin"), Found reference to API "//Vsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Polynomial-time solution" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Clone" (Indicator: "clone"; Source: "sample.bin"), Found reference to API "WinForms_RecursiveFormCreate" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "breadth-first\s*search" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Breadth-First Search" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "read"; Source: "sample.bin"), Found reference to API "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Vsync" (Indicator: "sync"; Source: "sample.bin")28:Tb42,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %p)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")29:T66c,Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")2a:Tf15,Found reference to API "TpSetTimer" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWaitForMultipleObjects32" (Indicator: "NtWaitForMultipleObjects"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlQueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlSetTimer" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwSetTimer" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwSetTimerEx" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwSetTimerResolution" (Indicator: "SetTimer"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwWaitForMultipleObjects32" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")2b:T512,Found reference to API "NtImpersonateThread" (Indicator: "NtImpersonateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")2c:Td82,Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a") Found reference to "The cryptographic provider does not support HMAC." (Indicator: "HMAC"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003796.00000001.80507.012A2000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003796.00000001.80507.012A2000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003796.00000001.80507.012A2000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003796.00000001.80507.012A2000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003796.00000001.80507.012A2000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003796.00000001.80507.012A2000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003796.00000001.80507.012A2000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004080.00000001.79477.012A2000.00000020.mdmp, 00000000-00004080.00000002.80501.005F0000.00000004.mdmp, 00000000-00004080.00000002.80501.00AB0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004080.00000001.79477.012A2000.00000020.mdmp, 00000000-00004080.00000002.80501.005F0000.00000004.mdmp, 00000000-00004080.00000002.80501.00AB0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004080.00000001.79477.012A2000.00000020.mdmp, 00000000-00004080.00000002.80501.005F0000.00000004.mdmp, 00000000-00004080.00000002.80501.00AB0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004080.00000001.79477.012A2000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004080.00000001.79477.012A2000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00004080.00000001.79477.012A2000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00004080.00000001.79477.012A2000.00000020.mdmp")2d:T1968,Assembly shows XOR instruction xor edi dword ptr [ebp+10h] in Stream UID: 00000000-00003796-47724-4-0041AF60 Assembly shows XOR instruction xor eax dword ptr [esi+04h] in Stream UID: 00000000-00003796-47724-4-0041AF60 Assembly shows XOR instruction xor ecx edi in Stream UID: 00000000-00003796-47724-13-00409DB0 Assembly shows XOR instruction xor eax dword ptr [ebp+ecx*4-00000400h] in Stream UID: 00000000-00003796-47724-13-00409DB0 Assembly shows XOR instruction xor eax 04C11DB7h in Stream UID: 00000000-00003796-47724-14-00409D70 Assembly shows XOR instruction xor ecx dword ptr [eax+14h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx dword ptr [eax+18h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx dword ptr [eax+04h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx edi in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx dword ptr [eax-10h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx dword ptr [eax+08h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx edx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor edx dword ptr [eax-04h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor eax ebx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor ecx dword ptr [ebp-04h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor edx dword ptr [ebp-04h] in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor esi ecx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00003796-47724-77-00409E60 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003796-47724-81-0041C3F0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003796-47724-81-0041C3F0 Assembly shows XOR instruction xor eax 0618D8CBh in Stream UID: 00000000-00003796-47724-81-0041C3F0 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003796-47724-105-0041C440 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003796-47724-105-0041C440 Assembly shows XOR instruction xor eax 0618D8CBh in Stream UID: 00000000-00003796-47724-105-0041C440 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00003796-47724-145-00409310 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00003796-47724-169-00409C30 Assembly shows XOR instruction xor dword ptr [esi+000004ACh] ecx in Stream UID: 00000000-00003796-47724-171-00409C90 Assembly shows XOR instruction xor dword ptr [esi+00000498h] edx in Stream UID: 00000000-00003796-47724-173-00409620 Assembly shows XOR instruction xor dword ptr [esi+00000488h] ecx in Stream UID: 00000000-00003796-47724-176-004097B0 Assembly shows XOR instruction xor dword ptr [esi+0000048Ch] ecx in Stream UID: 00000000-00003796-47724-178-00409550 Assembly shows XOR instruction xor dword ptr [esi+0000048Ch] eax in Stream UID: 00000000-00003796-47724-178-00409550 Assembly shows XOR instruction xor dword ptr [esi+00000474h] ecx in Stream UID: 00000000-00003796-47724-179-00409AB0 Assembly shows XOR instruction xor edx dword ptr [esi+04h] in Stream UID: 00000000-00003796-47724-181-0041B2B0 Assembly shows XOR instruction xor dword ptr [esi+000004B0h] edx in Stream UID: 00000000-00003796-47724-182-0041B0F0 Assembly shows XOR instruction xor eax dword ptr [esi+14h] in Stream UID: 00000000-00003796-47724-182-0041B0F0 Assembly shows XOR instruction xor eax edi in Stream UID: 00000000-00003796-47724-199-00418BC0 Assembly shows XOR instruction xor dword ptr [ebx] eax in Stream UID: 00000000-00003796-47724-235-00401300 Assembly shows XOR instruction xor dword ptr [esi-08h] ecx in Stream UID: 00000000-00003796-47724-235-00401300 Assembly shows XOR instruction xor dword ptr [esi-04h] edx in Stream UID: 00000000-00003796-47724-235-00401300 Assembly shows XOR instruction xor dword ptr [esi] ecx in Stream UID: 00000000-00003796-47724-235-00401300 Assembly shows XOR instruction xor cl byte ptr [edi] in Stream UID: 00000000-00003796-47724-235-00401300 Assembly shows XOR instruction xor dword ptr [edi] edx in Stream UID: 00000000-00003796-47724-239-00401210 Assembly shows XOR instruction xor dword ptr [edi+04h] ecx in Stream UID: 00000000-00003796-47724-239-00401210 Assembly shows XOR instruction xor dword ptr [edi+08h] edx in Stream UID: 00000000-00003796-47724-239-00401210 Assembly shows XOR instruction xor dword ptr [edi+0Ch] ecx in Stream UID: 00000000-00003796-47724-239-00401210 Assembly shows XOR instruction xor dword ptr [esi] ecx in Stream UID: 00000000-00003796-47724-240-00401180 Assembly shows XOR instruction xor dword ptr [esi+04h] edx in Stream UID: 00000000-00003796-47724-240-00401180 Assembly shows XOR instruction xor dword ptr [esi+08h] ecx in Stream UID: 00000000-00003796-47724-240-00401180 Assembly shows XOR instruction xor dword ptr [esi+0Ch] edx in Stream UID: 00000000-00003796-47724-240-00401180 Assembly shows XOR instruction xor byte ptr [ebp-10h] E1h in Stream UID: 00000000-00003796-47724-240-00401180 Assembly shows XOR instruction xor eax dword ptr [esi+04h] in Stream UID: 00000000-00003796-47724-433-0041BA60 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00003796-47724-501-004091502e:T4e8,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption2f:T71d,Found XOR loop in file "sample.bin" at offset 234185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 239758; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 579612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 583718; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 82124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 227157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 289177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 305245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 333422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 401942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 448300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 539605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 568485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 600073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 623954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 122596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 130368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 133168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 151703; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 231820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 530574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 581372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 600806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 686990; code bytes = 803030:T53f,Found system information discovery API: "NtQuerySystemInformation" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformationEx" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "RtlExpandEnvironmentStrings_U" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "RtlGetNativeSystemInformation" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "ZwQuerySystemInformationEx" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found system information discovery API: "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp"31:T80e,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000288ce3a0023750056000000000000000000000000800000000000000023750056d0763b000100000000000000020000000c00000038313b0038313b0033313b0000000000000000000000360000000001d8f0250000000000f8f6250095e1b87768f16a00feffffff435cbc775059bc7794000000a000000032313b0030313b00940000007cf22500fdfe09775ceb250001000000f8f62500a2e0ba6bfe527f08feffffff14f225005c9cba6b5c0c000028f225006f9cba6b0000000000000000 (UID: 00000000-00004080)32:T6be,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300f80e360011000011475f000040923b0088ce3a00b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6bc77d03ff377f42e2772603c3a00a0352772203ff377b8dc250018163a00b2f4bc77303ff377c8dc250000002072000020720000000024dc2500f0000000f00020720000000034dc250053000000c8dd2500000000000100000098dc250040f5bc77000000000000000084dc2500 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c474d74b0e943008c474d7400000000b0e943007cd42500086dbc771881c4770000000030d5250000000000de540165bcd4250095e1b87780f26a00feffffff6b2cbd773119ae7502100000000000000000010090d42500c89fbc778c474d740000000000000000 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004080)33:T28b4,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter 2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004080)34:Tacf6,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStream (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateProcessAsUser (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003796) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003796) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003796) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003796)35:T54a,Found reference to API "NtCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlCreateProcessParameters" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlCreateProcessParametersEx" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlCreateProcessReflection" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlpCreateProcessRegistryInfo" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateProcessEx" (Indicator: "CreateProcess"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "CreateProcessAsUser" (Indicator: "CreateProcess"; Source: "00000000-00004080.00000001.79477.04240000.00000004.mdmp, 00000000-00004080.00000002.80501.04240000.00000004.mdmp")36:T584,Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "CreateFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines." (Indicator: "NtCreateFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenFile" (Indicator: "ZwOpenFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")37:T51a,Found reference to API "FindResourceEx API exit" (Indicator: "FindResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "FindResource API exit" (Indicator: "FindResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "LoadResource API entry" (Indicator: "LoadResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "LdrFindResourceDirectory_U" (Indicator: "FindResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "LdrFindResourceEx_U" (Indicator: "FindResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "LdrResFindResource" (Indicator: "FindResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "LdrResFindResourceDirectory" (Indicator: "FindResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "LdrpLoadResourceFromAlternativeModule" (Indicator: "LoadResource"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")38:Ta12,Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")39:T1748,"Registry\Machine\Software\Microsoft\Windows nt\currentversion\appcompatflags\AIT" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Appcompat\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\Session Manager\Subsystems\CSRSS" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledProcesses\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\CommonDatapoints\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledSessions\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\AdaptiveSqm\Throttling" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004080.00000000.77556.00360000.00000004.mdmp 00000000-00004080.00000001.79477.00360000.00000004.mdmp 00000000-00004080.00000002.80501.00360000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004080.00000000.77556.00360000.00000004.mdmp 00000000-00004080.00000001.79477.00360000.00000004.mdmp 00000000-00004080.00000002.80501.00360000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004080.00000001.79477.00360000.00000004.mdmp 00000000-00004080.00000002.80501.00360000.00000004.mdmp3a:T93d,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135]3b:T19f9,"Registry\Machine\Software\Microsoft\Windows nt\currentversion\appcompatflags\AIT" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Appcompat\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\Session Manager\Subsystems\CSRSS" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledProcesses\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\CommonDatapoints\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledSessions\" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\AdaptiveSqm\Throttling" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004080.00000000.77556.00360000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004080.00000000.77556.00360000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004080.00000001.79477.00360000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004080.00000001.79477.00360000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004080.00000001.79477.00360000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004080.00000002.80501.00360000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004080.00000002.80501.00360000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004080.00000002.80501.00360000.00000004.mdmp "HKCU\" in Source: 00000000-00004080.00000002.80501.00AB0000.00000004.mdmp3c:T1a03,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71440000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "KERNEL32" at base 77050000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "ADVAPI32.DLL" at base 77cc0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c030000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "SHLWAPI.DLL" at base 77290000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "VERSION.DLL" at base 74f10000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64f20000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "USER32.DLL" at base 77740000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "MSCOREE.DLL" at base 6c0c0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "PSAPI.DLL" at base 77040000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "RPCRT4.DLL" at base 771e0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "KERNEL32.DLL" at base 77050000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63b10000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "OLE32.DLL" at base 75db0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "CRYPTBASE.DLL" at base 75970000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74800000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 630b0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6a8c0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73970000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68920000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62890000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 626a0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 74840000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "CRYPTSP.DLL" at base 75480000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75210000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "SHELL32.DLL" at base 76030000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76ec0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "PROFAPI.DLL" at base 75a90000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "BCRYPT.DLL" at base 75590000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "ADVAPI32" at base 77cc0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61830000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 659c0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 610b0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "NTDLL.DLL" at base 77b70000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "IMM32.DLL" at base 77d70000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "COMCTL32.DLL" at base 72200000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "GDI32.DLL" at base 778b0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "GDIPLUS.DLL" at base 74360000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74360000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77050000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "WINDOWSCODECS.DLL" at base 73e20000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "OLEAUT32.DLL" at base 77810000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76ec0000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "RPCRTREMOTE.DLL" at base 75a10000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75920000 "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72b500003d:T4bd,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3e:Tf5f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004080-00000C2B-220222973] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004080-00000C2B-220536614] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004080-00000C2B-221543928] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004080-00000C2B-221676384] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004080-00000C2B-221914930] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004080-00000C2B-221976178] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004080-00000C2B-222115161] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004080-00000C2B-222443041] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004080-00000C2B-222524982] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004080-00000C2B-222682290] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004080-00000C2B-222770809] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00004080-00000C2B-222849404] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004080-00000C2B-223443494] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004080-00000C2B-223502236] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004080-00000C2B-223560935] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004080-00000C2B-223633896] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004080-00000C2B-225250249] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004080-00000C2B-226266803] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004080-00000C2B-227896117] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004080-00000C2B-228100361] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004080-00000C2B-228194417] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004080-00000C2B-228644864] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00004080-00000C2B-228895601] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004080-00000C2B-229324637]3f:T82c,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")40:Tbd8,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")41:T546,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.v9921e851#\a891970b44db9e340c3ef3efa95b793c\microsoft.visualbasic.ni.dll.aux" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux"42:Tcfc,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\FLTLIB.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\MSVCP140.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\VCRUNTIME140.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\ucrtbase.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"43:Tcf7,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\MSVCP140.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\ucrtbase.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"44:T8ad,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe.config" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Sn5\" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.INI" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe.Local\" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\2A899EE00E6F2B09C002A3DC271E3EC7D15A7C98B8A3D9500F96DFD7FE941F4A.EXE.CONFIG" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SN5" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\2A899EE00E6F2B09C002A3DC271E3EC7D15A7C98B8A3D9500F96DFD7FE941F4A.INI" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" trying to access non-existent file "C:\2A899EE00E6F2B09C002A3DC271E3EC7D15A7C98B8A3D9500F96DFD7FE941F4A.EXE.LOCAL"45:T1107,Found reference to API "An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "The computer WAS able to connect on a secondary transport." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "The system bios failed to connect a system interrupt to the device or bus for which the device is connected." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product." (Indicator: " shutdown "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Please shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Please click OK to shutdown this system and reboot into Safe Mode, check the event log for more detailed information." (Indicator: " shutdown "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Please click OK to shutdown the system. You can use the recovery console to diagnose the system further." (Indicator: " shutdown "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "A system shutdown is in progress." (Indicator: " shutdown "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Indicates that there was an AuthIP failure when attempting to connect to the remote host." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "An attempt has been made to connect to a session whose video mode is not supported by the current client." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "The client failed to respond to the server connect message." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Your request to connect to this Terminal server has been rejected." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Windows can't connect to your session because a problem occurred in the Windows video subsystem. Try connecting again later, or contact the server administrator for assistance." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Specified VidPN source cannot be used because there is no available VidPN target to connect it to." (Indicator: " connect "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "Inspecting leaks at process shutdown ..." (Indicator: " shutdown "; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003796.00000001.80507.01360000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004080.00000000.77556.00360000.00000004.mdmp, 00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004080.00000000.77556.00360000.00000004.mdmp, 00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004080.00000000.77556.01360000.00000002.mdmp, 00000000-00004080.00000001.79477.01360000.00000002.mdmp")46:T6c0,Found string "The local machine must be a Kerberos KDC (domain controller) and it is not." (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while validating the KDC certificate during smartcard Logon. There is more information in the system event log." (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The Kerberos protocol encountered an error while attempting to utilize the smartcard subsystem." (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The target server does not have acceptable Kerberos credentials." (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "An unsupported preauthentication mechanism was presented to the Kerberos package." (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "Kerberos sub-protocol User2User is required." (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The Kerberos subsystem encountered an error. A service for user protocol request was made against a domain controller which does not support service for user." (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp")47:T5f6,Found registry query API: "NtEnumerateKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "NtEnumerateValueKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "NtQueryKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "NtQueryValueKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "RtlCheckRegistryKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "RtlpNtQueryValueKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "ZwEnumerateKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "ZwEnumerateValueKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "ZwQueryKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "ZwQueryValueKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "ZwSaveKey" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "ZwSaveKeyEx" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp" Found registry query API: "RtlQueryRegistryValues: Miscomputed buffer size at line %d" in "00000000-00003796.00000001.80507.006C0000.00000004.mdmp"48:Teac,"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004080) "2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004080)49:T42f,Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlGetCurrentDirectory_U" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwQueryAttributesFile" (Indicator: "QueryAttributesFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwQueryFullAttributesFile" (Indicator: "QueryFullAttributesFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")4a:T12bf,Found string "The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided as the current password is not correct." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The user account's password has expired." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "You specified an incorrect password to a LAN Manager 2.x or MS-NET server." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions." (Indicator: "secret"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The workstation does not have a trust secret for the primary domain in the local LSA database." (Indicator: "secret"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The user's password must be changed before logging on the first time." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The password provided is too short to meet the policy of your user account. Please choose a longer password." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Please select a password that you have not previously used." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "Mutual Authentication failed. The server's password is out of date at the domain controller." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "Security Account Manager needs to get the boot password." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The local account store does not contain secret material for the specified account." (Indicator: "secret"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The BitLocker startup key or recovery password could not be read from external media." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The BitLocker startup key or recovery password file is corrupt or invalid." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found string "The BitLocker encryption key could not be obtained from the startup key or recovery password." (Indicator: "password"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")4b:T165e,Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByType" (Indicator: "AccessCheckByType"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByType"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultList" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByType"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarm" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByType"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAccessCheckByTypeResultListAndAuditAlarmByHandle" (Indicator: "AccessCheckByTypeResultList"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessAllowedObjectAce" (Indicator: "AddAccessAllowedObjectAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAccessDeniedObjectAce" (Indicator: "AddAccessDeniedObjectAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAce" (Indicator: "AddAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAce" (Indicator: "AddAuditAccessAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessAceEx" (Indicator: "AddAuditAccessAceEx"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddAuditAccessObjectAce" (Indicator: "AddAuditAccessObjectAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAreAllAccessesGranted" (Indicator: "AreAllAccessesGranted"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "RtlAreAnyAccessesGranted" (Indicator: "AreAnyAccessesGranted"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")4c:T486,Found reference to API "NtInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwInitiatePowerAction" (Indicator: "InitiatePowerAction"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwRaiseHardError" (Indicator: "RaiseHardError"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwSetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp") Found reference to API "ZwShutdownSystem" (Indicator: "ShutdownSystem"; Source: "00000000-00003796.00000001.80507.006C0000.00000004.mdmp")4d:T14f0,Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000040-Na34~t5H8 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000041-Na34~n9FN Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000043-Na34~p0JH Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000044-Na34~Br02 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000045-Na34~Hz2x Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000046-Na34~So6n Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000047-Na34~x8E0 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000048-Na34~Ln73 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at 1eca8e2ba8d4939400ef3b6f315a68f2-6000072-Zd20~k0ZQ Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-600008e-o6RM~Fw12 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000e6-Sw3j~i4ZA Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000e7-Sw3j~Zo53 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000e8-Sw3j~q2F7 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000e9-Sw3j~Tn0p Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000ea-Sw3j~Fw2k Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000eb-Sw3j~Jb9d Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000ec-Sw3j~Cs20 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000ed-Sw3j~Qb9t Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000ee-Sw3j~Tp5n Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000ef-Sw3j~w5WF Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000f0-Sw3j~Hm5x Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000f1-Sw3j~n2SW Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000f2-Sw3j~At43 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000f3-Sw3j~f2G1 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 1eca8e2ba8d4939400ef3b6f315a68f2-60000f4-Sw3j~e1YW4e:T664,Wrote 7 instructions to a remote process Wrote 27 instructions to a remote process Wrote 20 instructions to a remote process Wrote 43 instructions to a remote process Wrote 12 instructions to a remote process Wrote 10 instructions to a remote process Wrote 154 instructions to a remote process Wrote 19 instructions to a remote process Wrote 56 instructions to a remote process Wrote 79 instructions to a remote process Wrote 54 instructions to a remote process Wrote 32 instructions to a remote process Wrote 36 instructions to a remote process Wrote 29 instructions to a remote process Wrote 24 instructions to a remote process Wrote 13 instructions to a remote process Wrote 30 instructions to a remote process Wrote 276 instructions to a remote process Wrote 33 instructions to a remote process Wrote 44 instructions to a remote process Wrote 48 instructions to a remote process Wrote 70 instructions to a remote process Wrote 104 instructions to a remote process Wrote 18 instructions to a remote process Wrote 78 instructions to a remote process Wrote 126 instructions to a remote process Wrote 34 instructions to a remote process Wrote 40 instructions to a remote process Wrote 37 instructions to a remote process Wrote 22 instructions to a remote process Wrote 16 instructions to a remote process Wrote 53 instructions to a remote process Wrote 83 instructions to a remote process Wrote 255 instructions to a remote process Wrote 38 instructions to a remote process Wrote 72 instructions to a remote process Wrote 28 instructions to a remote process Wrote 17 instructions to a remote process4f:Tca4,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "An invalid initial stack was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "An invalid initial start address was specified in a call to NtCreateThread." (Indicator: "CreateThread"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "VirtualAllocdBlocks" (Indicator: "VirtualAlloc"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlFreeMemoryBlockLookaside" (Indicator: "FreeMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwWow64AllocateVirtualMemory64" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp")50:T844,Found reference to API "RTL: RtlNtStatusToDosError(0x%lx): No Valid Win32 Error Mapping" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "QuerySystemInformation"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtWow64GetNativeSystemInformation" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlExpandEnvironmentStrings" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlExpandEnvironmentStrings_U" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlGetNativeSystemInformation" (Indicator: "RtlGetNativeSystemInformation"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlGetNativeSystemInformation" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwQuerySystemInformationEx" (Indicator: "QuerySystemInformation"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwWow64GetNativeSystemInformation" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp")51:Te94,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006864-00000C28-1531015062] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006864-00000C25-2013593277] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006864-00000C25-2013688965] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006864-00000C25-2013743425] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006864-00000C25-2013820320] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006864-00000C25-2013846374] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006864-00000C25-2013902134] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00006864-00000C25-2013998247] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006864-00000C25-2014183449] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006864-00000C25-2014250008] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006864-00000C25-2014279707] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006864-00000C25-2014383376] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006864-00000C25-2014407152] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00006864-00000C25-2014434248] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00006864-00000C25-2015905889] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006864-00000C25-2016593721] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006864-00000C25-2017124227] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00006864-00000C25-2017220620] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00006864-00000C25-2017465535] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00006864-00000C25-2018081527] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006864-00000C25-2018450605] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006864-00000C25-2018897273] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006864-00000C25-2023947802] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006864-00000C25-2024045745]52:T954,"Payment.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006864) "Payment.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00006864) "Payment.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006864)53:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp")54:T6b2,Found reference to API "RtlpQueryRegistryValues: Miscomputed buffer size at line %d" (Indicator: "QueryRegistryValues"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtEnumerateKey" (Indicator: "NtEnumerateKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQueryKey" (Indicator: "NtQueryKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQueryValueKey" (Indicator: "QueryValueKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlQueryRegistryValues" (Indicator: "QueryRegistryValues"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlQueryRegistryValuesEx" (Indicator: "QueryRegistryValues"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlpNtQueryValueKey" (Indicator: "QueryValueKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwEnumerateKey" (Indicator: "ZwEnumerateKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwQueryKey" (Indicator: "ZwQueryKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwQueryValueKey" (Indicator: "QueryValueKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwSaveKey" (Indicator: "ZwSaveKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwSaveKeyEx" (Indicator: "ZwSaveKey"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp")55:T51e,Found reference to API "SwitchedRtlGetVersion_Current" (Indicator: "RtlGetVersion"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "Allows getting the 6.2 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_Win8" (Indicator: "RtlGetVersion"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "Allows getting the 6.3 version only from a special RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "SwitchedRtlGetVersion_WinBLUE" (Indicator: "RtlGetVersion"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "Return correct version from VerifyVersionInfo's call to RtlGetVersion." (Indicator: "RtlGetVersion"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlGetNtProductType" (Indicator: "RtlGetNtProductType"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp")56:T832,Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "NtQuerySystemInformationEx" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp") Found reference to API "ZwOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00001960.00000000.195716.035CC000.00000004.mdmp")57:T481,"Payment.exe wrote PE header bytes ("4d5a4552e8000000005883e8098bc883c03c8b0003c183c0280308ffe190000000000000000000000000000000000000000000000000000000000000c00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000abfc08eaef9d66b9ef9d66b9ef9d66b9f400cdb9a99d66b9f400f8b9ec9d66b9f400fbb9ee9d66b952696368ef9d66b900000000000000000000000000000000504500004c010100a35d254d0000000000000000e00002010b010a0000d202000000000000000000d0f001000010000000f002000000400000100000000200000500010000000000050001000000000000f0020000020000000000000200408100001000001000000000100000100000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002e7465787400000034d102000010000000d2020000100000000000000000000000000000200000600000000000000000000000000000000000000000000000000000000000000000") to a remote process "C:\Payment.exe" which might be an injection preparation attempt ...1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790610061650,"unified_at":"2026-09-28T15:41:01.650Z","metadata":{"hashes":{"sha256":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","sha1":"6729aea498f4d5d67bd78776a309cd3c7c06e3cb","md5":"1eca8e2ba8d4939400ef3b6f315a68f2","sha512":"c826420eeaa3cb9726de4a20ff92b8d66b13b9edfd625e1955d9f5d44c86ba2987686789e99dc42c4f8ec734090259e9c7c4582fba05e7d8b02f6bd899718159","ssdeep":"12288:mY5Qvy6uSajv6QAcFahFRavD7R5GMYG2ucItiyE:t5QvTuSar6QgjGqGV","ssdeep_chunks":["12288:mY5Qvy6","12288:Y5Qvy6u","12288:5Qvy6uS","12288:Qvy6uSa","12288:vy6uSaj","12288:y6uSajv","12288:6uSajv6","12288:uSajv6Q","12288:Sajv6QA","12288:ajv6QAc","12288:jv6QAcF","12288:v6QAcFa","12288:6QAcFah","12288:QAcFahF","12288:AcFahFR","12288:cFahFRa","12288:FahFRav","12288:ahFRavD","12288:hFRavD7","12288:FRavD7R","12288:RavD7R5","12288:avD7R5G","12288:vD7R5GM","12288:D7R5GMY","12288:7R5GMYG","12288:R5GMYG2","12288:5GMYG2u","12288:GMYG2uc","12288:MYG2ucI","12288:YG2ucIt","12288:G2ucIti","12288:2ucItiy","12288:ucItiyE","24576:mY5Qvy6","24576:Y5Qvy6u","24576:5Qvy6uS","24576:Qvy6uSa","24576:vy6uSaj","24576:y6uSajv","24576:6uSajv6","24576:uSajv6Q","24576:Sajv6QA","24576:ajv6QAc","24576:jv6QAcF","24576:v6QAcFa","24576:6QAcFah","24576:QAcFahF","24576:AcFahFR","24576:cFahFRa","24576:FahFRav","24576:ahFRavD","24576:hFRavD7","24576:FRavD7R","24576:RavD7R5","24576:avD7R5G","24576:vD7R5GM","24576:D7R5GMY","24576:7R5GMYG","24576:R5GMYG2","24576:5GMYG2u","24576:GMYG2uc","24576:MYG2ucI","24576:YG2ucIt","24576:G2ucIti","24576:2ucItiy","24576:ucItiyE","12288:t5QvTuS","12288:5QvTuSa","12288:QvTuSar","12288:vTuSar6","12288:TuSar6Q","12288:uSar6Qg","12288:Sar6Qgj","12288:ar6QgjG","12288:r6QgjGq","12288:6QgjGqG","12288:QgjGqGV"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Payment.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":731648,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1720225055000,"last_seen":1787891090000,"last_multi_scan":1787891090000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","loader","darktortilla","criminal","informationstealer","formbook","windows-server-utility"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":3,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":212,"suspicious_count":23,"malicious_count":12,"total":247},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/MSIL.Noon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.137935","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Msilzilla-10030292-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.137935 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.ALWT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Agent.jk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 005d5b131 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.LHC.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4829855","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.MSILZilla","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"DarkTortilla","sources":[{"report_type":"qsp","report_id":""}]},{"value":"FormBook","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"suspicious","value":"YARA signature match - MD5 algorithm"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Able to access mailslot-related API (String)"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"suspicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"},{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to lock or unlock file/device object (API string)"},{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Delete file or directory"},{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Marks file for deletion"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"informative","value":"Contains ability to query/modify extended-attribute values of a file (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Loads syscall stubs from disk during runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Submission/internal name is suspicious for an executable"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to open handle to a named event object (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Contains ability to measure performance"},{"type":"informative","value":"Found registry location string related to processor"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve the current system language"},{"type":"informative","value":"Able to retrieve the system language code"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"},{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Possible high-risk domain detected"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Contains ability to check internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contacts random domain names"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"n'y.kr\", Heuristic match: \"j<.mg\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"6.9.12.15\", \"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"3AeSFK\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"The specified compression format is unsupported.\" (Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found string \"The compression operation could not be completed because a transaction is active on the file.\" (Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlCompressBuffer\" (Indicator: \"RtlCompressBuffer\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlComputeCrc32\" (Indicator: \"RtlComputeCrc32\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlDecompressBuffer\" (Indicator: \"RtlDecompressBuffer\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"An invalid initial stack was specified in a call to NtCreateThread.\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"An invalid initial start address was specified in a call to NtCreateThread.\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtCreateThread\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"After a callback to 0x%p(0x%p), an completion call to FreeLibrary(%p) failed with status 0x%08x.\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a has big resource with name: \"resources/pxicma.png\" size: \"322000\" and abnormal entropy:\"7.999485289175317\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003796.00000002.80532.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004080.00000002.80501.005F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004080.00000002.80501.00AB0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\CON; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" queried SystemProcessInformation at 00000000-00004080-00000105-9621896 [PID: 4080]\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" queried SystemProcessInformation at 00000000-00004080-00000105-15309497 [PID: 4080]\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" queried SystemProcessInformation at 00000000-00003796-00000105-35327356 [PID: 3796]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004080.00000000.77556.00360000.00000004.mdmp, 00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00003796.00000001.80507.012A2000.00000020.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00004080.00000001.79477.012A2000.00000020.mdmp, 00000000-00004080.00000002.80501.005F0000.00000004.mdmp, 00000000-00004080.00000002.80501.00AB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \"CreateDecryptor\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.CreateDecryptor\" in Source: 2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"Write\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"\n Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004080.00000000.77556.00360000.00000004.mdmp, 00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \"set_Key\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \"get_Key\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \"CreateDecryptor\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004080.00000000.77556.00360000.00000004.mdmp, 00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.12058","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004080-00000C2C-228363206\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004080-00000C2C-228803253\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformationEx\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwQuerySystemInformation\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwQuerySystemInformationEx\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004080-00000C2C-228363206\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004080-00000C2C-228803253\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found string \"NtQuerySystemInformationEx\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004080-00000C2C-228390093\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004080-00000C2C-221667392\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004080-00000C2C-221671434\")\n Found reference to API \"RtlAllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlFreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"RtlGetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlpGetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the current system language","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"ntquerydefaultuilanguage\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"ntqueryinstalluilanguage\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-737","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the system language code","description":"Found reference to API \"NtQueryDefaultUILanguage\" (Indicator: \"NtQueryDefaultUILanguage\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQueryInstallUILanguage\" (Indicator: \"NtQueryInstallUILanguage\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-837","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00004080-00000C2C-270090057\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00004080-00000C2C-270090126\")\n Found reference to API \"WMRSendMessageString\" (Indicator: \"sendmessage\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004080)\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004080)\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"IsWow64Process\" with parameter \"4080\" - (UID: 00000000-00004080)\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"IsWow64Process\" with parameter \"3796\" - (UID: 00000000-00003796)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004080)\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwQueryVolumeInformationFile\" (Indicator: \"ZwQueryVolumeInformationFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to set LDT entries (API string)","description":"Found reference to API \"NtSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwSetLdtEntries\" (Indicator: \"SetLdtEntries\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-542","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" queries volume information of \"C:\\2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" at 00000000-00004080-0000010C-2796781","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"ZwCreateKey\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"\n Found registry modification API: \"ZwCreateKeyTransacted\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"\n Found registry modification API: \"ZwCreateKeyedEvent\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"NtOpenProcess\" (Indicator: \"NtOpenProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlGetProcessHeaps\" (Indicator: \"RtlGetProcessHeaps\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwOpenProcess\" (Indicator: \"ZwOpenProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004080)\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003796.00000001.80507.012A2000.00000020.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004080.00000001.79477.012A2000.00000020.mdmp, 00000000-00004080.00000002.80501.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Inserting %u hooks into target image\" (Source: 00000000-00003796.00000001.80507.006C0000.00000004.mdmp, Indicator: \"inserting %u hooks into target image\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"NtCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwCreateDirectoryObject\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Contains ability to open handle to a named event object (API string)","description":"Found reference to API \"NtOpenEvent\" (Indicator: \"NtOpenEvent\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtOpenEventPair\" (Indicator: \"NtOpenEvent\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwOpenEvent\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwOpenEventPair\" (Indicator: \"ZwOpenEvent\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-467","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify extended-attribute values of a file (API string)","description":"Found reference to API \"ZwQueryEaFile\" (Indicator: \"ZwQueryEaFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwSetEaFile\" (Indicator: \"ZwSetEaFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.004","relevance":1,"id":"string-268","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"InternetGetConnectedState\" in \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63B10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75590000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64770000\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64F20000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 771E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e00fe02106c@ADVAPI32.dll\"\n \"0b000c00cc02106c@ADVAPI32.dll\"\n \"10001100da02106c@ADVAPI32.dll\"\n \"150016002073bb6b@ADVAPI32.dll\"\n \"0e000f00e473bb6b@ADVAPI32.dll\"\n \"0e000f005074bb6b@ADVAPI32.dll\"\n \"11001200d47dbb6b@ADVAPI32.dll\"\n \"110012007c7ebb6b@ADVAPI32.dll\"\n \"12001300cc7ebb6b@ADVAPI32.dll\"\n \"12001300387fbb6b@ADVAPI32.dll\"\n \"14001500e4b7bb6b@ADVAPI32.dll\"\n \"1400150000b8bb6b@ADVAPI32.dll\"\n \"140015001cb8bb6b@ADVAPI32.dll\"\n \"1700180038b8bb6b@ADVAPI32.dll\"\n \"0d000e0054b8bb6b@ADVAPI32.dll\"\n \"1100120064b8bb6b@ADVAPI32.dll\"\n \"110012007cb8bb6b@ADVAPI32.dll\"\n \"0f001000ecb9bb6b@ADVAPI32.dll\"\n \"1400150038babb6b@ADVAPI32.dll\"\n \"1400150054babb6b@ADVAPI32.dll\"\n \"0c000d00a8babb6b@ADVAPI32.dll\"\n \"0c000d00b8babb6b@ADVAPI32.dll\"\n \"0e000f00c8babb6b@ADVAPI32.dll\"\n \"0e000f00dcbabb6b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" was detected as \".NET\" and name: \"Library\"\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (UID: 00000000-00003796) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (UID: 00000000-00003796) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (UID: 00000000-00003796)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (UID: 00000000-00003796)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"LdrGetDllHandleByMapping\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"LdrGetDllHandleByName\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"LdrGetDllHandleEx\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform Process Doppelganging (API string)","description":"Found reference to API \"NtRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwRollbackTransaction\" (Indicator: \"RollbackTransaction\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-420","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQueueApcThreadEx\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwQueueApcThreadEx\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsCodecs.dll\" (UID: 4080)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=92362.the\" - Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found URL \"http://go.microso\" - Source: \"00000000-00004080.00000001.79477.00360000.00000004.mdmp\")\n Found URL \"http://ns.adobebimresinfo8bimiptcdigesappexttime//purl.org/dobe.com/xmp/identifier/dobe.com/xabe.com/xap/1.0/t/pg/tiffhttpttp://ns.adobe.com/xap/1p://ns.adob/stype/resourceref\" - Source: \"00000000-00004080.00000001.79477.04700000.00000004.mdmp\")\n Found URL \"http://www.w3.org/1999/02/22-rdf-syntax-ns\" - Source: \"00000000-00004080.00000001.79477.04700000.00000004.mdmp\")\n Found URL \"http://go.microso\" - Source: \"00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003796\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \":\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00004080.00000000.77556.00360000.00000004.mdmp, 00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEB6DA919348DC48949EAFE337C4AB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$46","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access mailslot-related API (String)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-921","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"y|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004080.00000000.77556.00360000.00000004.mdmp\n 00000000-00004080.00000001.79477.00360000.00000004.mdmp\n 00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQuerySecurityObject\" (Indicator: \"NtQuerySecurityObject\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQuerySystemInformationEx\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"NtCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwCreateMailslotFile\" (Indicator: \"CreateMailslot\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"NtGetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlGetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"RtlGetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwGetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwReadFile\" (Indicator: \"ZwReadFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"LdrGetProcedureAddressEx\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"SE_GetProcAddressLoad\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"CsrGetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"NtGetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"NtDeleteKey\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"\n Found registry deletion API: \"NtDeleteValueKey\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"\n Found registry deletion API: \"RtlDeleteRegistryValue\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"\n Found registry deletion API: \"ZwDeleteKey\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"\n Found registry deletion API: \"ZwDeleteValueKey\" in \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004080)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004080.00000000.77556.00360000.00000004.mdmp, 00000000-00004080.00000001.79477.00360000.00000004.mdmp, 00000000-00004080.00000002.80501.00360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUser\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00004080.00000001.79477.04240000.00000004.mdmp, 00000000-00004080.00000002.80501.04240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"NtDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to lock or unlock file/device object (API string)","description":"Found reference to API \"The range specified in NtUnlockFile was not locked.\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtLockFile\" (Indicator: \"NtLockFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtUnlockFile\" (Indicator: \"NtUnlockFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-473","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"ZwQueryInformationToken\" (Indicator: \"ZwQueryInformationToken\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwSetInformationFile\" (Indicator: \"ZwSetInformationFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"NtTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwTerminateProcess\" (Indicator: \"ZwTerminateProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"After a callback to 0x%p(0x%p), a completion call to ReleaseMutex(%p) failed with status 0x%08x.\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")\n Found reference to API \"TpCallbackReleaseMutexOnCompletion\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003796.00000001.80507.006C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Loads syscall stubs from disk during runtime","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" trying to read a file \"C:\\Windows\\System32\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1027.007","relevance":3,"id":"api-298","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" at 00000000-00004080-00000105-4581170\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" at 00000000-00003796-00000105-35303975","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" has section name .text with entropy \"7.116868648455049\"\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" has section name .rsrc with entropy \"7.656015868902306\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe queries ProcessDebugPort (UID: 3796)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00000000-00003796-47724-179-00409AB0\n rdtsc at 00000000-00003796-47724-180-00409900","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/23 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a\" has resource with unusual entropy \"RT_ICON:7.945794791433285\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$4d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4010850\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3010851\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" opened \"C:\\2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\\:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"C:\\2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Submission/internal name is suspicious for an executable","description":"Input file type is \".NET exe\" and the name \"Payment.exe\" contains indicator \"payment\"","origin":"Monitored Target","mitre_attack_id":"T1036","relevance":10,"id":"target-40","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" opened \"C:\\2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\\:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$4e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/23 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"15/23 Antivirus vendors marked spawned process \"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a.exe\" (PID: 3796) as malicious (classified as \"IL:Trojan.MSILZilla\" with 65% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"Payment.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006864)\n \"Payment.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006864)\n \"Payment.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006864)\n \"Payment.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"Payment.exe\" called \"LoadResource with parameter {'hModule': '75890689', 'hResInfo': '75891936'}\" (UID: 00000000-00006864)\n \"Payment.exe\" called \"LoadResource with parameter {'hModule': '75890689', 'hResInfo': '75891968'}\" (UID: 00000000-00006864)\n \"Payment.exe\" called \"LoadResource with parameter {'hModule': '75890689', 'hResInfo': '75891984'}\" (UID: 00000000-00006864)\n \"Payment.exe\" called \"LoadResource with parameter {'hModule': '75890689', 'hResInfo': '75891952'}\" (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"Payment.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006864.00000000.192244.005B0000.00000004.mdmp, 00000000-00006864.00000001.194163.005B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.192244.005B0000.00000004.mdmp\n 00000000-00006864.00000001.194163.005B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"RtlGetSystemTimePrecise\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"RtlGetSystemTimePrecise\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00006864.00000000.192244.005B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"TermsrvGetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"RtlGetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"RtlpGetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"Payment.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"Payment.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001960.00000001.195727.00D02000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"ZwCreateKey\" (Indicator: \"ZwCreateKey\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"ZwCreateKeyTransacted\" (Indicator: \"ZwCreateKey\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"ZwCreateKeyedEvent\" (Indicator: \"ZwCreateKey\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessTokenEx\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"RtlGetProcessHeaps\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"ZwOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"ZwOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"ZwOpenProcessTokenEx\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Payment.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 720E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Payment.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Payment.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Payment.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Payment.exe.log]- [targetUID: 00000000-00006864]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Payment.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006864)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Payment.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\payment.exe.log\"\n \"Payment.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\payment.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Payment.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Payment.exe.log\"\n \"Payment.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Payment.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001960\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Payment.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"Payment.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"NtDeleteKey\" (Indicator: \"NtDeleteKey\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"NtDeleteValueKey\" (Indicator: \"DeleteValueKey\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"ZwDeleteKey\" (Indicator: \"ZwDeleteKey\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")\n Found reference to API \"ZwDeleteValueKey\" (Indicator: \"DeleteValueKey\"; Source: \"00000000-00001960.00000000.195716.035CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"Payment.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")\n \"Payment.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PAYMENT.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Payment.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Payment.exe.log]- [targetUID: 00000000-00006864]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"runtimebroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Payment.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6864)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.11686864846\n 7.6560158689","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"C:\\Payment.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on process \"00000000-00001960\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-112","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Payment.exe\" wrote 00000004 bytes to a remote process \"C:\\Payment.exe\" (Handle: 1556)\n \"Payment.exe\" wrote 00000200 bytes to a remote process \"C:\\Payment.exe\" (Handle: 1556)\n \"Payment.exe\" wrote 0002D200 bytes to a remote process \"C:\\Payment.exe\" (Handle: 1556)\n \"Payment.exe\" wrote 00000004 bytes to a remote process \"C:\\Payment.exe\" (Handle: 1584)\n \"Payment.exe\" wrote 00000200 bytes to a remote process \"C:\\Payment.exe\" (Handle: 1584)\n \"Payment.exe\" wrote 0002D200 bytes to a remote process \"C:\\Payment.exe\" (Handle: 1584)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004624.00000002.214050.00910000.00000040.mdmp, 00000000-00004624.00000002.214050.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"control.exe\" (Thread ID: 3808) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004624.00000002.214050.00910000.00000040.mdmp, 00000000-00004624.00000002.214050.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004624.00000002.214050.00910000.00000040.mdmp, 00000000-00004624.00000002.214050.00A50000.00000004.mdmp\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004648.00000001.212849.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00004648.00000001.212849.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004624.00000002.214050.00910000.00000040.mdmp, 00000000-00004624.00000002.214050.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"Firefox.exe\" (UID: 00000000-00004960)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.catboxbot.online\"\n \"www.hokivegasslots.club\"\n \"www.osthirmaker.com\"\n \"www.rlc2019.com\"\n \"www.symboleffekt.info\"\n \"www.topcomparativos.com\"\n \"www.xzcn3i7jb13cqei.buzz\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"control.exe\" is creating a new process (Name: \"C:\\Windows\\SysWOW64\\cmd.exe\")\n \"control.exe\" is creating a new process (Name: \"C:\\Program Files\\Mozilla Firefox\\Firefox.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Payment.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"Payment.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"Payment.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"Payment.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"Payment.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"c ping 127.0.0.1 -n\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00004648.00000001.212849.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Payment.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"83953797\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Payment.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"167839880\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004624.00000002.214050.00910000.00000040.mdmp, 00000000-00004624.00000002.214050.00A50000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004624.00000002.214050.00910000.00000040.mdmp, 00000000-00004624.00000002.214050.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004624.00000002.214050.00910000.00000040.mdmp, 00000000-00004624.00000002.214050.00A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004648.00000001.212849.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00004648.00000001.212849.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"cmd.exe\" marked \"C:\\Payment.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"/c del \"C:\\Payment.exe\"\" (Indicator: \"/c del \") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"8LAlogim.jpeg\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1728x804 components 3\" and extension \"jpeg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"Payment.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"General","name":"Delete file or directory","description":"Process \"cmd.exe\" with commandline \"/c del \"C:\\\\Payment.exe\"\" (UID: 00000000-00001696)","origin":"Monitored Target","mitre_attack_id":"T1070.004","relevance":3,"id":"target-164","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"control.exe\" allocated memory in \"%WINDIR%\\SysWOW64\\control.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Network Related","name":"Contacts random domain names","description":"\"www.rlc2019.com\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Network Related","name":"Possible high-risk domain detected","description":"Domain: \"www.topcomparativos.com\" possible high risk indicator","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004648.00000001.212849.00840000.00000004.mdmp, 00000000-00004648.00000002.213979.00840000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"c ping 127.0.0.1 -n\" (Indicator: \"ping\"; Source: \"00000000-00004648.00000001.212849.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"$57","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"IMPLANT_4_v7\" matched process \"00000000-00004624\" as \"BlackEnergy / Voodoo Bear Implant by APT28\" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, Author: US CERT)\n YARA signature \"PlugXBootLDRCode\" matched process \"00000000-00004624\" as \"PlugX boot.ldr code tricks\" (Author: Seth Hardy)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"Payment.exe\" (UID: 00000000-00004648)\n Spawned process \"Payment.exe\" (UID: 00000000-00004056)\n Spawned process \"Payment.exe\" (UID: 00000000-00004624)\n Spawned process \"control.exe\" (UID: 00000000-00005092)\n Spawned process \"cmd.exe\" with commandline \"/c del \"C:\\\\Payment.exe\"\" (UID: 00000000-00001696)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to hide tracks of having downloaded a file from the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}],"intel_graph":{"map":{"Domain:www.catboxbot.online":{"type":"Domain","value":"www.catboxbot.online"},"Domain:www.hokivegasslots.club":{"type":"Domain","value":"www.hokivegasslots.club"},"Domain:www.osthirmaker.com":{"type":"Domain","value":"www.osthirmaker.com"},"Domain:www.rlc2019.com":{"type":"Domain","value":"www.rlc2019.com"},"Domain:www.symboleffekt.info":{"type":"Domain","value":"www.symboleffekt.info"},"Domain:www.topcomparativos.com":{"type":"Domain","value":"www.topcomparativos.com"},"Domain:www.xzcn3i7jb13cqei.buzz":{"type":"Domain","value":"www.xzcn3i7jb13cqei.buzz"},"File:1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361":{"type":"File","value":"1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361"},"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a":{"type":"File","value":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat DarkTortilla","confirmed relationship with a Threat FormBook"]}},"File:6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507":{"type":"File","value":"6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507"},"File:93c85f3205ae1b926724d52f342936f9faf404e85ed52f31da1febbfbcaa315d":{"type":"File","value":"93c85f3205ae1b926724d52f342936f9faf404e85ed52f31da1febbfbcaa315d"},"File:e4328c3951f1ee7368d6dec4f1c50d7f077a26ebd6f9ccf0902baa598c1165fd":{"type":"File","value":"e4328c3951f1ee7368d6dec4f1c50d7f077a26ebd6f9ccf0902baa598c1165fd"},"File:eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae":{"type":"File","value":"eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae"},"File:fcc5b40f4329583b35bb692f89f5601d6393fa67eb9932bfb46fb0f56a238ceb":{"type":"File","value":"fcc5b40f4329583b35bb692f89f5601d6393fa67eb9932bfb46fb0f56a238ceb"},"Threat:03f3dfdc0a1c11bda77e976cdc6ab377d707c6ee22262a0d893ec7f5e59c90b5":{"type":"Threat","value":"DarkTortilla","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:dfcbbe09f9d62712b26cb3d02c4d757c7abab69f78d74b604bac127d84947ee0":{"type":"Threat","value":"FormBook","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1542751801929135629","root":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat DarkTortilla","confirmed relationship with a Threat FormBook"]}},{"id":"1542751801929135628","root":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Threat:03f3dfdc0a1c11bda77e976cdc6ab377d707c6ee22262a0d893ec7f5e59c90b5"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542751801929135627","root":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Threat:dfcbbe09f9d62712b26cb3d02c4d757c7abab69f78d74b604bac127d84947ee0"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","edges":[{"edge_kind":"contacted_domain","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Domain:www.catboxbot.online"},{"edge_kind":"contacted_domain","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Domain:www.hokivegasslots.club"},{"edge_kind":"contacted_domain","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Domain:www.osthirmaker.com"},{"edge_kind":"contacted_domain","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Domain:www.rlc2019.com"},{"edge_kind":"contacted_domain","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Domain:www.symboleffekt.info"},{"edge_kind":"contacted_domain","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Domain:www.topcomparativos.com"},{"edge_kind":"contacted_domain","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"Domain:www.xzcn3i7jb13cqei.buzz"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","edges":[{"edge_kind":"extracted","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"File:93c85f3205ae1b926724d52f342936f9faf404e85ed52f31da1febbfbcaa315d"},{"edge_kind":"extracted","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"File:e4328c3951f1ee7368d6dec4f1c50d7f077a26ebd6f9ccf0902baa598c1165fd"},{"edge_kind":"extracted","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"File:fcc5b40f4329583b35bb692f89f5601d6393fa67eb9932bfb46fb0f56a238ceb"},{"edge_kind":"extracted","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"File:1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361"},{"edge_kind":"extracted","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"File:eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae"},{"edge_kind":"extracted","from_key":"File:2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","to_key":"File:6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":128,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":7,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","loader","darktortilla","criminal","informationstealer","formbook","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","Network Traffic"],"sandbox_reports":[{"id":"6a85493344c735d3df04d84a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILZilla","submit_name":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","analysis_start_time":"2026-08-19T06:12:04+00:00","indicators_count":{"informative":152,"suspicious":21,"malicious":6},"tags":["Multi-Process"],"is_in_unified_schema":true},{"id":"66888d802747c9f24b0bc43b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Payment.exe","analysis_start_time":"2024-07-06T00:19:12+00:00","indicators_count":{"informative":143,"suspicious":19,"malicious":5},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"66888d1f76797db5a7057ede","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Payment.exe","analysis_start_time":"2024-07-06T00:17:35+00:00","indicators_count":{"informative":112,"suspicious":24,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"www.catboxbot.online","country":"-","registrar_name":"Registrar of Domain Names REG.RU LLC","registrar_name_servers":"NS1.REG.RU","registrar_creation_date":"2024-06-08T07:08:49+00:00","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"domain":"www.hokivegasslots.club","country":"-","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"domain":"www.osthirmaker.com","country":"-","registrar_name":"Cloudflare, Inc.","registrar_organization":"DATA REDACTED","registrar_name_servers":"DAYANA.NS.CLOUDFLARE.COM","registrar_creation_date":"2024-06-08T11:13:00+00:00","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"domain":"www.rlc2019.com","country":"-","registrar_name":"GMO INTERNET, INC.","registrar_organization":"Whois Privacy Protection Service by onamae.com","registrar_name_servers":"NS-WH1.WEB.Z.COM","registrar_creation_date":"2024-06-08T02:07:17+00:00","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"domain":"www.symboleffekt.info","country":"-","registrar_name":"IONOS SE","registrar_name_servers":"ns1043.ui-dns.com","registrar_creation_date":"2024-06-08T16:00:52+00:00","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"domain":"www.topcomparativos.com","country":"-","registrar_name":"INWX GmbH","registrar_organization":"My Domain Provider","registrar_name_servers":"NS1.DNS-PARKING.COM","registrar_creation_date":"2024-06-08T13:41:14+00:00","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"domain":"www.xzcn3i7jb13cqei.buzz","country":"-","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}],"processes":[{"pid":4648,"ppid":0,"name":"Payment.exe","command_line":"","sha256":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","normalized_path":"C:\\Payment.exe","uid":"00000000-00004648","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABEUlEQVR4Xu2XQQrCMBREvY8N1pULr1DQ07iwPYP0JHoNxSN4BUFcNilUIqSkk/z4CY2L0g+zcH478wgt2MUickS17mzhfrTJqnxQRAnvixpRusFcYRZ7MChWmMseDIrV8/WO0gwwHYDNaTuQKaD8aAAp5VfoU0WUHwSgSozv22EwV0EAu+j6uDleMgAbommabnlcBcu1qKOm/J8ANoRRUe+da5ICZGXelyulnL0tDOYqCNCqdnACGgivSQZQ1Lu++Hy//P8ZMIX6AdS/lVRBCKqI8oMApki/ej7fB4HBXAUB0A/tMJgrL0CMqKOm/OkBYDBXM8B0APDfdtSIg3CCucKsUYfzxYT3JB/8ZsT9PNz5ADPcCciWzCtsAAAAAElFTkSuQmCC"},{"pid":4056,"ppid":4648,"name":"Payment.exe","command_line":"","sha256":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","normalized_path":"C:\\Payment.exe","parent_uid":"00000000-00004648","uid":"00000000-00004056"},{"pid":4624,"ppid":4648,"name":"Payment.exe","command_line":"","sha256":"2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a","normalized_path":"C:\\Payment.exe","parent_uid":"00000000-00004648","uid":"00000000-00004624"},{"pid":5092,"ppid":0,"name":"control.exe","command_line":"","sha256":"9678f973ddb06f3f77cddfe8c9f3152beb87aef5ef048b36966a2be787f5ad70","normalized_path":"%WINDIR%\\SysWOW64\\control.exe","uid":"00000000-00005092","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABEUlEQVR4Xu2XQQrCMBREvY8N1pULr1DQ07iwPYP0JHoNxSN4BUFcNilUIqSkk/z4CY2L0g+zcH478wgt2MUickS17mzhfrTJqnxQRAnvixpRusFcYRZ7MChWmMseDIrV8/WO0gwwHYDNaTuQKaD8aAAp5VfoU0WUHwSgSozv22EwV0EAu+j6uDleMgAbommabnlcBcu1qKOm/J8ANoRRUe+da5ICZGXelyulnL0tDOYqCNCqdnACGgivSQZQ1Lu++Hy//P8ZMIX6AdS/lVRBCKqI8oMApki/ej7fB4HBXAUB0A/tMJgrL0CMqKOm/OkBYDBXM8B0APDfdtSIg3CCucKsUYfzxYT3JB/8ZsT9PNz5ADPcCciWzCtsAAAAAElFTkSuQmCC"},{"pid":1696,"ppid":5092,"name":"cmd.exe","command_line":"/c del \"C:\\Payment.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005092","uid":"00000000-00001696"},{"pid":4960,"ppid":5092,"name":"Firefox.exe","command_line":"","sha256":"0960e76e8b3811fa7900f893d2bdaed933a7b68ee2183bb28309493bf45950e5","normalized_path":"%PROGRAMFILES%\\Mozilla Firefox\\Firefox.exe","parent_uid":"00000000-00005092","uid":"00000000-00004960"}],"all_imported_dlls":["api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","mscorlib.ni.dll","cryptsp.dll","advapi32.dll","ole32.dll","oleaut32.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","version.dll","uxtheme.dll","rsaenh.dll","api-ms-win-core-processthreads-l1-1-1.dll","imm32.dll","System.Windows.Forms.ni.dll","System.Xml.ni.dll","api-ms-win-crt-convert-l1-1-0.dll","profapi.dll","psapi.dll","lpk.dll","vcruntime140.dll","vcruntime140_clr0400.dll","WindowsCodecs.dll","apphelp.dll","msvcrt.dll","rpcrt4.dll","api-ms-win-crt-runtime-l1-1-0.dll","ucrtbase.dll","ws2_32.dll","cryptbase.dll","bcrypt.dll","api-ms-win-crt-string-l1-1-0.dll","shlwapi.dll","msctf.dll","VxSSL32.dll","clr.dll","clrjit.dll","user32.dll","ucrtbase_clr0400.dll","GdiPlus.dll","fltLib.dll","System.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","comctl32.dll","mscoree.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","KernelBase.dll","api-ms-win-core-timezone-l1-1-0.dll","nsi.dll","nlssorting.dll","System.Configuration.ni.dll","kernel32.dll","ntdll.dll","msvcp140.dll","api-ms-win-crt-time-l1-1-0.dll","Microsoft.VisualBasic.ni.dll","mscoreei.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","sechost.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","System.Drawing.ni.dll","shell32.dll","RpcRtRemote.dll","gdi32.dll","api-ms-win-core-file-l1-2-0.dll","rpcss.dll","System.Core.ni.dll","mscorrc.dll","usp10.dll","clbcatq.dll","bcryptprimitives.dll","MpOAV.dll","win32u.dll","gdi32full.dll","kernel.appcore.dll","System.Drawing.dll","cfgmgr32.dll","powrprof.dll","msasn1.dll","gpapi.dll","System.Windows.Forms.dll","slc.dll","dwmapi.dll","DWrite.dll","wintrust.dll","msvcp_win.dll","MpClient.dll","Microsoft.VisualBasic.dll","crypt32.dll","sppc.dll","Accessibility.dll","wow64win.dll","amsi.dll","wow64.dll","windows.storage.dll","wow64cpu.dll","wldp.dll","combase.dll","userenv.dll","sspicli.dll","SHCore.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","winbrand.dll","wininet.dll","iertutil.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","nss3.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ieframe.dll","wsock32.dll","api-ms-win-crt-multibyte-l1-1-0.dll","vaultcli.dll","softokn3.dll","nssdbm3.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mozglue.dll","winmm.dll","tzres.dll","normaliz.dll","dbghelp.dll","freebl3.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Payment.exe.log","sha256":"93c85f3205ae1b926724d52f342936f9faf404e85ed52f31da1febbfbcaa315d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"name":"8LAlogim.jpeg","sha256":"e4328c3951f1ee7368d6dec4f1c50d7f077a26ebd6f9ccf0902baa598c1165fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"8LAlogrc.ini","sha256":"fcc5b40f4329583b35bb692f89f5601d6393fa67eb9932bfb46fb0f56a238ceb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"8LAlogrf.ini","sha256":"1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"8LAlogri.ini","sha256":"eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"8LAlogrv.ini","sha256":"6eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Payment.exe.log","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"},{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a85493344c735d3df04d84a"}]},{"name":"Local\\SM0:6864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"name":"SM0:6864:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"name":"SM0:6864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66888d802747c9f24b0bc43b"}]},{"name":"\\BaseNamedObjects\\884B9844F1EZYLEz","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"\\BaseNamedObjects\\8LAR698WF5468WZz","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\S-1-5-21-6864120-49601968909035","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]},{"name":"S-1-5-21-6864120-49601968909035","sources":[{"report_type":"sandbox","report_id":"66888d1f76797db5a7057ede"}]}]}},"report_ids":{"sandbox_job_ids":["6a85493344c735d3df04d84a","66888d802747c9f24b0bc43b","66888d1f76797db5a7057ede"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious IL:Trojan.MSILZilla Sample 2a899ee00e6f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2a899ee00e6f…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/25 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.MSILZilla Sample 2a899ee00e6f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2a899ee00e6f…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/25 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2a899ee00e6f2b09c002a3dc271e3ec7d15a7c98b8a3d9500f96dfd7fe941f4a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.MSILZilla Sample 2a899ee00e6f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2a899ee00e6f…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 17/25 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]]