21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample 2acb08478abe… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2acb08478abe…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 11/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7"],"about":{"@type":"SoftwareApplication","name":"payload1dec.bin.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Td3e,Found reference to "FileHashAlgorithmiriteEventerrord" (Indicator: "HashAlgorithm"; File: "screen_2.png") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "TripleDES112" (Indicator: "TripleDES"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "SHA512" (Indicator: "SHA512"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMAC_SHA1_DES3" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "SHA384" (Indicator: "SHA384"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMACMD5" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMACMD5" (Indicator: "HMACMD5"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "ARCFOUR_HMAC_MD5" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMAC_SHA1_96_AES_256" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "ARCFOUR_HMAC_MD5_56" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "AES256_CTS_HMAC_SHA1_96" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "AES128_CTS_HMAC_SHA1_96" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMAC_MD5_96" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMAC_SHA256_128" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMAC_SHA1_96_AES_128" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "STATUS_TPM_20_E_HMAC" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HMAC_MD5_ENC" (Indicator: "HMAC"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004912-00000BC0-1279990222") Found reference to "at NtApiDotNet.Utilities.ASN1.DefaultNameClaimTypeArgCount.DynamicILGeneratordepHnd.FileHashAlgorithmWriteEventErrorCode(IntPtr, IntPtr, IntPtr)" (Indicator: "HashAlgorithm"; Source: "00000000-00004912.00000000.144999.F2320000.00000004.mdmp") Found reference to "at NtApiDotNet.Utilities.ASN1.DefaultNameClaimTypeArgCount.DynamicILGeneratordepHnd.FileHashAlgorithmWriteEventErrorCode(IntPtr dest, IntPtr src, IntPtr count)" (Indicator: "HashAlgorithm"; Source: "00000000-00004912.00000000.144999.F2320000.00000004.mdmp") Found reference to "IntPtr FileHashAlgorithmWriteEventErrorCode(IntPtr, IntPtr, IntPtr)" (Indicator: "HashAlgorithm"; Source: "00000000-00004912.00000000.144999.F2320000.00000004.mdmp")23:T80e,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000000e6de5b640a800000800000000000000ffffffffffffffff3400000000000000a426f15efb7f000078ec0f1158000000db04fe74fb7f000000000000fb7f00002a96be71fb7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000e0ec0f11580000000800000000000000000000000000000000000000000000007e7be4b640a80000c3f0fc74fb7f0000000067f2f5010000a713fd74fb7f000038ed0f11 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004912)24:T1048,NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,System.Boolean,NtApiDotNet.TokenAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6001185-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(System.Int32,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001187-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600117c-NtToken~OpenProcessToken NtApiDotNet.Win32.Win32NativeMethods::LookupPrivilegeName(System.String,NtApiDotNet.Luid&,System.Text.StringBuilder,System.Int32&) at 65aeb7eaa825e0bd836cece1d1edfae2-60015d0-TokenPrivilege~get_Name NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60011a8-NtToken~PseudoToHandle NtApiDotNet.NtToken::OpenProcessToken(System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001181-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-600119c-NtToken~Impersonate NtApiDotNet.NtSystemCalls::NtOpenProcess(NtApiDotNet.SafeKernelObjectHandle&,NtApiDotNet.ProcessAccessRights,NtApiDotNet.ObjectAttributes,NtApiDotNet.ClientId) at 65aeb7eaa825e0bd836cece1d1edfae2-6000c19-NtProcess~Open NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,System.Boolean,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001186-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,System.Boolean,NtApiDotNet.TokenAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6001183-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken() at 65aeb7eaa825e0bd836cece1d1edfae2-6000bc7-NtObjectWithDuplicate_2~GetMaximumAccess NtApiDotNet.NtToken::OpenProcessToken(System.Int32,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001193-NtToken~OpenEffectiveToken NtApiDotNet.IPeb::GetProcessHeap() at 65aeb7eaa825e0bd836cece1d1edfae2-6003034-cctorb__9_0 NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,System.Boolean,NtApiDotNet.TokenAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600117d-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000c4f-NtProcess~OpenToken NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600289d-FirewallConditionBuilder~AddProcess NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000a8c-NtKeyUtils~CreateWin32BaseKeys NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights,NtApiDotNet.AttributeFlags,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600117a-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,System.Boolean,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600117e-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000c0f-NtProcess~QueryTokenT NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001180-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(NtApiDotNet.NtProcess,NtApiDotNet.TokenAccessRights,NtApiDotNet.AttributeFlags,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600117b-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(System.Int32,System.Boolean,NtApiDotNet.TokenAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6001184-NtToken~OpenProcessToken NtApiDotNet.NtToken::OpenProcessToken(System.Int32,System.Boolean,NtApiDotNet.TokenAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001190-NtToken~OpenEffectiveToken NtApiDotNet.NtToken::OpenProcessToken(System.Boolean,NtApiDotNet.TokenAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6001182-NtToken~OpenProcessToken25:T1a7b,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\2b185c0f47b7e9417ee580b326bea804\System.ServiceProcess.ni.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter C:\psapi.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter C:\msvcrt.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004912)26:T55ce,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004912)27:T864,NtApiDotNet.NtFile::CreateNamedPipe(NtApiDotNet.ObjectAttributes,NtApiDotNet.FileAccessRights,NtApiDotNet.FileShareMode,NtApiDotNet.FileOpenOptions,NtApiDotNet.FileDisposition,NtApiDotNet.NamedPipeType,NtApiDotNet.NamedPipeReadMode,NtApiDotNet.NamedPipeCompletionMode,System.Int32,System.Int32,System.Int32,NtApiDotNet.NtWaitTimeout,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600071c-NtFile~CreateNamedPipe NtApiDotNet.NtFile::CreateNamedPipe(System.String,NtApiDotNet.NtObject,NtApiDotNet.FileAccessRights,NtApiDotNet.FileShareMode,NtApiDotNet.FileOpenOptions,NtApiDotNet.FileDisposition,NtApiDotNet.NamedPipeType,NtApiDotNet.NamedPipeReadMode,NtApiDotNet.NamedPipeCompletionMode,System.Int32,System.Int32,System.Int32,NtApiDotNet.NtWaitTimeout,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600071f-NtFile~CreatePipePair NtApiDotNet.NtSystemCalls::NtCreateNamedPipeFile(NtApiDotNet.SafeKernelObjectHandle&,NtApiDotNet.FileAccessRights,NtApiDotNet.ObjectAttributes,NtApiDotNet.IoStatus,NtApiDotNet.FileShareMode,NtApiDotNet.FileDisposition,NtApiDotNet.FileOpenOptions,NtApiDotNet.NamedPipeType,NtApiDotNet.NamedPipeReadMode,NtApiDotNet.NamedPipeCompletionMode,System.Int32,System.Int32,System.Int32,NtApiDotNet.LargeInteger) at 65aeb7eaa825e0bd836cece1d1edfae2-600071b-NtFile~CreateNamedPipe NtApiDotNet.NtFile::CreateNamedPipe(System.String,NtApiDotNet.NtObject,NtApiDotNet.FileAccessRights,NtApiDotNet.FileShareMode,NtApiDotNet.FileOpenOptions,NtApiDotNet.FileDisposition,NtApiDotNet.NamedPipeType,NtApiDotNet.NamedPipeReadMode,NtApiDotNet.NamedPipeCompletionMode,System.Int32,System.Int32,System.Int32,NtApiDotNet.NtWaitTimeout,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600071e-NtFile~CreateNamedPipe NtApiDotNet.NtFile::CreateNamedPipe(NtApiDotNet.ObjectAttributes,NtApiDotNet.FileAccessRights,NtApiDotNet.FileShareMode,NtApiDotNet.FileOpenOptions,NtApiDotNet.FileDisposition,NtApiDotNet.NamedPipeType,NtApiDotNet.NamedPipeReadMode,NtApiDotNet.NamedPipeCompletionMode,System.Int32,System.Int32,System.Int32,NtApiDotNet.NtWaitTimeout,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600071d-NtFile~CreateNamedPipe28:T45c,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" failed to load missing module "C:\psapi.dll" - [base:0; Status:ffffffffc0000135] "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" failed to load missing module "C:\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135]29:T18d7,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "KERNEL32" at base 7ffb72a60000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb72e50000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb450c0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "ADVAPI32.DLL" at base 7ffb72da0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb52b40000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "SHLWAPI.DLL" at base 7ffb74e40000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb713a0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "VERSION.DLL" at base 7ffb68660000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb43150000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "USER32.DLL" at base 7ffb72f50000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "MSCOREE.DLL" at base 7ffb5e150000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "NTDLL" at base 7ffb74fc0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb74b30000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "PSAPI.DLL" at base 7ffb72d30000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "RPCRT4.DLL" at base 7ffb72b10000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "KERNEL32.DLL" at base 7ffb72a60000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffb41b50000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "OLE32.DLL" at base 7ffb730e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb74b30000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb716e0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb41a00000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffb40d90000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.SERV759BFB78#\2B185C0F47B7E9417EE580B326BEA804\SYSTEM.SERVICEPROCESS.NI.DLL" at base 7ffb51410000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb40c20000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "C:\PSAPI.DLL" at base 0 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "C:\MSVCRT.DLL" at base 0 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "MSVCRT.DLL" at base 7ffb72490000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffb40ab0000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffb40030000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb70750000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb71660000 "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7ffb72a600002a:Ta8c,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004912-00000C28-1279040690] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004912-00000C28-1279423418] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004912-00000C28-1279543850] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004912-00000C28-1279636258] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004912-00000C28-1279956713] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004912-00000C28-1280021782] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004912-00000C28-1280096584] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00004912-00000C28-1280307573] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004912-00000C28-1280814593] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\2b185c0f47b7e9417ee580b326bea804\System.ServiceProcess.ni.dll" [Source: 00000000-00004912-00000C28-1280944051] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00004912-00000C28-1281037377] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" [Source: 00000000-00004912-00000C28-1281460718] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004912-00000C28-1281548992] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004912-00000C28-1281572445] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004912-00000C28-1281597406] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll" [Source: 00000000-00004912-00000C28-1281707231] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004912-00000C28-1281764626]2b:T542,NtApiDotNet.NtSecurity::LookupAccountName(System.String) at 65aeb7eaa825e0bd836cece1d1edfae2-6001601-UserGroup~LookupAccountSid NtApiDotNet.NtSecurity::LookupAccountName(System.String,System.String) at 65aeb7eaa825e0bd836cece1d1edfae2-6000e4e-NtSecurity~LookupAccountName NtApiDotNet.Win32.Security.Native.SecurityNativeMethods::LsaLookupNames2(NtApiDotNet.Win32.SafeHandles.SafeLsaHandle,NtApiDotNet.Win32.Security.Policy.LsaLookupNameOptionFlags,System.Int32,NtApiDotNet.UnicodeStringIn[],NtApiDotNet.Win32.SafeHandles.SafeLsaMemoryBuffer&,NtApiDotNet.Win32.SafeHandles.SafeLsaMemoryBuffer&) at 65aeb7eaa825e0bd836cece1d1edfae2-6001b07-LsaPolicy~LookupNames NtApiDotNet.NtAtom::GetUserName(System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000622-NtAtom~GetName NtApiDotNet.NtSecurity::LookupAccountName(System.String) at 65aeb7eaa825e0bd836cece1d1edfae2-600315a-cctorb__160_0 NtApiDotNet.NtSecurity::LookupAccountName(System.String,System.String,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000e4d-NtSecurity~LookupAccountName NtApiDotNet.Win32.Win32NativeMethods::LookupAccountName(System.String,System.String,System.Runtime.InteropServices.SafeBuffer,System.Int32&,System.Runtime.InteropServices.SafeBuffer,System.Int32&,NtApiDotNet.Win32.SidNameUse&) at 65aeb7eaa825e0bd836cece1d1edfae2-6000e4c-NtSecurity~LookupAccountName2c:T969,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2d:Tf50,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "")2e:T52d,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.serv759bfb78#\2b185c0f47b7e9417ee580b326bea804\system.serviceprocess.ni.dll.aux" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.management\b221af81285c1305324612e6dc9c88ff\system.management.ni.dll.aux" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" reads file "c:\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux"2f:T584,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\FLTLIB.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to touch file "C:\Windows\System32\imm32.dll"30:Tdd3,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\PSAPI.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\psapi.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\MSVCRT.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\msvcrt.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VERSION.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL.DLL"31:T90c,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\2ACB08478ABE768457F22B505029F0D8FD79204543DC30B0BC7BD635C6A7DCE7.EXE.CONFIG" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2ACB08478ABE768457F22B505029F0D8FD79204543DC30B0BC7BD635C6A7DCE7.EXE.LOG" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe.config" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\YE Ω Ֆ B XΨ ՖOQ V Φ" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\2ACB08478ABE768457F22B505029F0D8FD79204543DC30B0BC7BD635C6A7DCE7.INI" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.INI" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\2ACB08478ABE768457F22B505029F0D8FD79204543DC30B0BC7BD635C6A7DCE7.PDB" "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" trying to access non-existent file "C:\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.PDB"32:Tc60,"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\ye (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\* (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter 2b185c0f47b7e9417ee580b326bea804 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004912) "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\* (UID: 00000000-00004912)33:Td1b,Found string "CBC_AES192" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "CBC_AES192" (Indicator: "aes192"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "GCM_AES192" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "GCM_AES192" (Indicator: "aes192"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "ParseBase64" (Indicator: "base64"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "ToBase64" (Indicator: "base64"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "base64" (Indicator: "base64"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "CertificateECDSA_P384" (Indicator: "ecdsa"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "SslECDSA_P384" (Indicator: "ecdsa"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "CertificateECDSA_P256" (Indicator: "ecdsa"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "SslECDSA_P256" (Indicator: "ecdsa"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "CBC_AES256" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "CBC_AES256" (Indicator: "aes256"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "GCM_AES256" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "GCM_AES256" (Indicator: "aes256"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "HMAC_SHA1_96_AES_256" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "AES256_CTS_HMAC_SHA1_96" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "AES256_CTS_HMAC_SHA1_96" (Indicator: "aes256"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "AES128_CTS_HMAC_SHA1_96" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "AES128_CTS_HMAC_SHA1_96" (Indicator: "aes128"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "CBC_AES128" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "CBC_AES128" (Indicator: "aes128"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "GCM_AES128" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "GCM_AES128" (Indicator: "aes128"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "HMAC_SHA1_96_AES_128" (Indicator: "aes"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found string "ECDSA" (Indicator: "ecdsa"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe")34:T959,Found reference to API "b__73_0" (Indicator: "PrivilegeCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__25_0" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__67_0" (Indicator: "ImpersonateAnonymousToken"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "AllocateLocallyUniqueId"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "AccessCheckByType"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "PrivilegeCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "DuplicateToken"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__0" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__1" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__1" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "AccessCheckResult`1" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe") Found reference to API "b__2" (Indicator: "AccessCheck"; File: "2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe")35:T9ec,NtApiDotNet.Win32.Win32NativeMethods::EnumServicesStatusEx(NtApiDotNet.Win32.SafeHandles.SafeServiceHandle,NtApiDotNet.Win32.SC_ENUM_TYPE,NtApiDotNet.Win32.ServiceType,NtApiDotNet.Win32.SERVICE_STATE,NtApiDotNet.SafeHGlobalBuffer,System.Int32,System.Int32&,System.Int32&,System.Int32&,System.String) at 65aeb7eaa825e0bd836cece1d1edfae2-6001a02-ServiceControlManager~GetServices NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-60019ff-ServiceControlManager~Open NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600181e-ServiceUtils~GetServiceProcessIds NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6001800-ServiceUtils~OpenService NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600181f-ServiceUtils~GetService NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600182e-ServiceUtils~CreateService NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6001813-ServiceUtils~GetServiceInformation NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600180f-ServiceUtils~SetScmSecurityDescriptor NtApiDotNet.Win32.Win32NativeMethods::QueryServiceStatusEx(NtApiDotNet.Win32.SafeHandles.SafeServiceHandle,NtApiDotNet.Win32.SC_STATUS_TYPE,System.Runtime.InteropServices.SafeBuffer,System.Int32,System.Int32&) at 65aeb7eaa825e0bd836cece1d1edfae2-60017fd-ServiceUtils~QueryStatus NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600181d-ServiceUtils~GetServiceProcessId NtApiDotNet.Win32.Win32NativeMethods::OpenSCManager(System.String,System.String,NtApiDotNet.Win32.ServiceControlManagerAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6001807-ServiceUtils~GetScmSecurityDescriptor36:Tbbb,NtApiDotNet.Win32.Win32NativeMethods::FindResource(NtApiDotNet.Win32.SafeLoadLibraryHandle,System.String,System.IntPtr) at 65aeb7eaa825e0bd836cece1d1edfae2-600175e-SafeLoadLibraryHandle~LoadResourceData NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001761-SafeLoadLibraryHandle~LoadResourceData NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResource(System.String,NtApiDotNet.Win32.Image.ImageResourceType) at 65aeb7eaa825e0bd836cece1d1edfae2-6001768-SafeLoadLibraryHandle~LoadResource NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResource(System.String,NtApiDotNet.Win32.Image.ImageResourceType) at 65aeb7eaa825e0bd836cece1d1edfae2-6001769-SafeLoadLibraryHandle~LoadResource NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,NtApiDotNet.Win32.Image.ImageResourceType) at 65aeb7eaa825e0bd836cece1d1edfae2-6001763-SafeLoadLibraryHandle~LoadResourceData NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600175f-SafeLoadLibraryHandle~LoadResourceData NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001760-SafeLoadLibraryHandle~LoadResourceData NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResource(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001766-SafeLoadLibraryHandle~LoadResource NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,NtApiDotNet.Win32.Image.ImageResourceType) at 65aeb7eaa825e0bd836cece1d1edfae2-6001762-SafeLoadLibraryHandle~LoadResourceData NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001764-SafeLoadLibraryHandle~LoadResource NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResource(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001767-SafeLoadLibraryHandle~LoadResource NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023fa-ctor NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResource(System.String,NtApiDotNet.Win32.Image.ImageResourceType,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001765-SafeLoadLibraryHandle~LoadResource NtApiDotNet.Win32.Security.Native.SecurityNativeMethods::AuthzFreeResourceManager(System.IntPtr) at 65aeb7eaa825e0bd836cece1d1edfae2-6002122-SafeAuthZResourceManagerHandle~ReleaseHandle NtApiDotNet.Win32.SafeLoadLibraryHandle::LoadResourceData(System.String,System.String,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001cac-AuthenticodeUtils~GetElamInformation37:T1830,NtApiDotNet.Win32.Net.Win32NetworkUtils::GetTcpListeners(System.Net.Sockets.AddressFamily,NtApiDotNet.Win32.Net.TCP_TABLE_CLASS,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023eb-Win32NetworkUtils~GetTcpListeners NtApiDotNet.Net.Firewall.FirewallNetEventListener/SubscribeFunc::Invoke(NtApiDotNet.Net.Firewall.SafeFwpmEngineHandle,NtApiDotNet.Net.Firewall.FWPM_NET_EVENT_SUBSCRIPTION0& at 65aeb7eaa825e0bd836cece1d1edfae2-6002a3c-FirewallNetEventListener~InitializeT, NtApiDotNet.Token.SkipSizeFNonBrowsable.JavasetAsBstr/NtApiDotNet.Win32.Security.Authentication.Negotiate.getZoneArgRankMultiDimNotSupported.CMSSECTIONIDIsFamilyOrAssembly::WantsToListenLinkedSlotVolatile() at 65aeb7eaa825e0bd836cece1d1edfae2-6002e83-cctor System.Linq.Enumerable::Select(System.Collections.Generic.IEnumerable`1,System.Func`2) at 65aeb7eaa825e0bd836cece1d1edfae2-60023d2-MIB_TCPTABLE_OWNER_MODULE~GetListeners NtApiDotNet.Win32.Net.Win32NetworkUtils::GetTcpListeners(System.Net.Sockets.AddressFamily,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023ec-Win32NetworkUtils~GetTcpListeners NtApiDotNet.Net.Sockets.SocketSecurityUtils::SetPeerTargetName(System.Net.Sockets.TcpListener,System.String,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002856-SocketSecurityUtils~SetPeerTargetName NtApiDotNet.Net.Firewall.FirewallNetEventListener::ReadEvent(System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-6002a42-FirewallNetEventListener~ReadEvent System.Linq.Enumerable::Select(System.Collections.Generic.IEnumerable`1,System.Func`2) at 65aeb7eaa825e0bd836cece1d1edfae2-60023d6-MIB_UDPTABLE_OWNER_MODULE~GetListeners System.Linq.Enumerable::Select(System.Collections.Generic.IEnumerable`1,System.Func`2) at 65aeb7eaa825e0bd836cece1d1edfae2-60023d4-MIB_TCP6TABLE_OWNER_MODULE~GetListeners NtApiDotNet.Net.Firewall.FirewallNetEventListener::StartInternal(NtApiDotNet.Net.Firewall.FirewallEngine,NtApiDotNet.Net.Firewall.FirewallNetEventListener/SubscribeFunc,NtApiDotNet.Net.Firewall.FirewallNetEventEnumTemplate,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002a3e-FirewallNetEventListener~Start4 NtApiDotNet.Win32.Net.Win32NetworkUtils::GetUdpListeners(System.Net.Sockets.AddressFamily,NtApiDotNet.Win32.Net.UDP_TABLE_CLASS,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023ef-Win32NetworkUtils~GetUdpListeners NtApiDotNet.Net.Firewall.FirewallNetEventListener::StartInternal(NtApiDotNet.Net.Firewall.FirewallEngine,NtApiDotNet.Net.Firewall.FirewallNetEventListener/SubscribeFunc,NtApiDotNet.Net.Firewall.FirewallNetEventEnumTemplate,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002a3f-FirewallNetEventListener~Start1 NtApiDotNet.Win32.Net.Win32NetworkUtils::GetListenerForTcpPort(System.Net.Sockets.AddressFamily,System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-600232d-RpcTcpClientTransport~GetServerProcess System.Linq.Enumerable::Select(System.Collections.Generic.IEnumerable`1,System.Func`2) at 65aeb7eaa825e0bd836cece1d1edfae2-60023d7-MIB_UDP6TABLE_OWNER_MODULE~GetListeners NtApiDotNet.Net.Sockets.SocketSecurityUtils::SetSecurity(System.Net.Sockets.TcpListener,NtApiDotNet.Net.Sockets.SocketSecuritySettings,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600284e-SocketSecurityUtils~SetSecurity NtApiDotNet.NtResult`1::get_Result() at 65aeb7eaa825e0bd836cece1d1edfae2-600290f-FirewallEngine~SubscribeNetEvents NtApiDotNet.Net.Firewall.FirewallNetEventListener::Initialize(NtApiDotNet.Net.Firewall.FirewallNetEventListener/SubscribeFunc,NtApiDotNet.Net.Firewall.IFirewallEnumTemplate`1) at 65aeb7eaa825e0bd836cece1d1edfae2-6002a3d-FirewallNetEventListener~StartInternalT NtApiDotNet.Win32.Net.IIpTable`2::GetListeners(NtApiDotNet.SafeStructureInOutBuffer`1) at 65aeb7eaa825e0bd836cece1d1edfae2-60023e6-Win32NetworkUtils~GetListenersT_U_V NtApiDotNet.Win32.Net.TcpListenerInformation::get_ProcessId() at 65aeb7eaa825e0bd836cece1d1edfae2-60023c8-ctor NtApiDotNet.Win32.Net.Win32NetworkUtils::GetListeners(NtApiDotNet.Win32.Net.GetExtendedTable`1,System.Net.Sockets.AddressFamily,NtApiDotNet.Win32.Net.TCP_TABLE_CLASS,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023e7-Win32NetworkUtils~GetTcpListenersT NtApiDotNet.Win32.Net.UdpListenerInformation::get_ProcessId() at 65aeb7eaa825e0bd836cece1d1edfae2-60023d1-ctor NtApiDotNet.Win32.Net.Win32NetworkUtils::GetUdpListeners(System.Net.Sockets.AddressFamily,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023f0-Win32NetworkUtils~GetUdpListeners NtApiDotNet.Win32.Net.TcpListenerInformation::get_ProcessId() at 65aeb7eaa825e0bd836cece1d1edfae2-60023c7-ctor NtApiDotNet.Win32.Net.UdpListenerInformation::get_LocalEndPoint() at 65aeb7eaa825e0bd836cece1d1edfae2-60023cb-UdpListenerInformation~get_LocalPort System.Net.Sockets.TcpListener::get_Server() at 65aeb7eaa825e0bd836cece1d1edfae2-6002855-SocketSecurityUtils~SetPeerTargetName38:T1552,NtApiDotNet.Win32.Net.Win32NetworkUtils::GetTcpListeners(System.Net.Sockets.AddressFamily,NtApiDotNet.Win32.Net.TCP_TABLE_CLASS,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023eb-Win32NetworkUtils~GetTcpListeners NtApiDotNet.Net.Firewall.FirewallNetEventListener/SubscribeFunc::Invoke(NtApiDotNet.Net.Firewall.SafeFwpmEngineHandle,NtApiDotNet.Net.Firewall.FWPM_NET_EVENT_SUBSCRIPTION0& at 65aeb7eaa825e0bd836cece1d1edfae2-6002a3c-FirewallNetEventListener~InitializeT, NtApiDotNet.Win32.Rpc.Transport.RpcAlpcClientTransport::BindInterface(System.Guid,System.Version) at 65aeb7eaa825e0bd836cece1d1edfae2-60022ca-RpcAlpcClientTransport~Bind NtApiDotNet.Token.SkipSizeFNonBrowsable.JavasetAsBstr/NtApiDotNet.Win32.Security.Authentication.Negotiate.getZoneArgRankMultiDimNotSupported.CMSSECTIONIDIsFamilyOrAssembly::WantsToListenLinkedSlotVolatile() at 65aeb7eaa825e0bd836cece1d1edfae2-6002e83-cctor NtApiDotNet.Win32.Win32NativeMethods::RpcStringBindingCompose(System.String,System.String,System.String,System.String,System.String,NtApiDotNet.Win32.SafeHandles.SafeRpcStringHandle&) at 65aeb7eaa825e0bd836cece1d1edfae2-6002153-SafeRpcBindingHandle~Create System.Linq.Enumerable::Select(System.Collections.Generic.IEnumerable`1,System.Func`2) at 65aeb7eaa825e0bd836cece1d1edfae2-60023d2-MIB_TCPTABLE_OWNER_MODULE~GetListeners NtApiDotNet.Win32.DirectoryService.DirectoryServiceBinding::Bind(System.String,System.String,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002450-DirectoryServiceBinding~Bind NtApiDotNet.Win32.DirectoryService.DirectoryServiceBinding::CrackNames(NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFlags,NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFormat,NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFormat,System.Collections.Generic.IEnumerable`1,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600244b-DirectoryServiceBinding~CrackName NtApiDotNet.Win32.Win32NativeMethods::RpcBindingToStringBinding(System.IntPtr,NtApiDotNet.Win32.SafeHandles.SafeRpcStringHandle&) at 65aeb7eaa825e0bd836cece1d1edfae2-6002155-SafeRpcBindingHandle~ToString NtApiDotNet.Net.Sockets.HyperVSocketGuids::IsVSockAddress(System.Guid) at 65aeb7eaa825e0bd836cece1d1edfae2-600281f-HyperVSocketGuids~GetVSockPort NtApiDotNet.Net.Sockets.SocketSecurityUtils::ToArray(System.Net.IPEndPoint) at 65aeb7eaa825e0bd836cece1d1edfae2-6002857-SocketSecurityUtils~DeletePeerTargetName NtApiDotNet.Win32.RpcEndpointMapper::CreateEndpoint(NtApiDotNet.Win32.SafeHandles.SafeRpcBindingHandle,NtApiDotNet.Win32.RPC_IF_ID) at 65aeb7eaa825e0bd836cece1d1edfae2-6003314-RpcEndpointMapperc__DisplayClass3_0~QueryEndpointsForBindingb__0 NtApiDotNet.Win32.DirectoryService.DirectoryServiceBinding::CrackName(NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFlags,NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFormat,NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFormat,System.String,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600244c-DirectoryServiceBinding~CrackName NtApiDotNet.Win32.DirectoryService.DirectoryServiceBinding::CrackNames(NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFlags,NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFormat,NtApiDotNet.Win32.DirectoryService.DirectoryServiceNameFormat,System.Collections.Generic.IEnumerable`1,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600244d-DirectoryServiceBinding~GetNamingContextNames NtApiDotNet.Win32.SafeHandles.SafeRpcBindingHandle::GetCrackedBinding() at 65aeb7eaa825e0bd836cece1d1edfae2-600214c-SafeRpcBindingHandle~get_Protseq System.Net.SocketAddress::set_Item(System.Int32,System.Byte) at 65aeb7eaa825e0bd836cece1d1edfae2-600280d-HyperVEndPoint~CopyGuid NtApiDotNet.Net.Sockets.HyperVEndPoint::get_ServiceId() at 65aeb7eaa825e0bd836cece1d1edfae2-6002818-HyperVEndPoint~ToString System.Net.Sockets.TcpClient::get_Client() at 65aeb7eaa825e0bd836cece1d1edfae2-6002853-SocketSecurityUtils~SetPeerTargetName NtApiDotNet.Net.Sockets.SocketSecuritySettings::ToBuffer() at 65aeb7eaa825e0bd836cece1d1edfae2-600284b-SocketSecurityUtils~SetSecurity NtApiDotNet.Win32.Net.Win32NetworkUtils::GetTcpListeners(System.Net.Sockets.AddressFamily,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-60023ec-Win32NetworkUtils~GetTcpListeners System.Net.SocketAddress::get_Family() at 65aeb7eaa825e0bd836cece1d1edfae2-6002817-HyperVEndPoint~Create NtApiDotNet.Net.Sockets.SocketSecurityUtils::SetPeerTargetName(System.Net.Sockets.TcpListener,System.String,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002856-SocketSecurityUtils~SetPeerTargetName NtApiDotNet.Win32.DirectoryService.DirectoryServiceNativeMethods::DsUnBind(System.IntPtr&) at 65aeb7eaa825e0bd836cece1d1edfae2-60024fd-SafeDirectoryServiceHandle~ReleaseHandle NtApiDotNet.Net.Firewall.FirewallNetEventListener::ReadEvent(System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-6002a42-FirewallNetEventListener~ReadEvent NtApiDotNet.Win32.SafeHandles.SafeRpcBindingHandle::Create(System.String,System.String,System.String,System.String,System.String,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002152-SafeRpcBindingHandle~Create39:Tfdd,NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig(System.String,System.String,System.String,System.Nullable`1,System.Nullable`1,System.Nullable`1,System.String,System.Nullable`1,System.String,System.Collections.Generic.IEnumerable`1,System.String,System.Security.SecureString,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600183d-ServiceUtils~ChangeServiceConfig NtApiDotNet.Win32.Win32NativeMethods::ChangeServiceConfig(NtApiDotNet.Win32.SafeHandles.SafeServiceHandle,NtApiDotNet.Win32.ServiceType,NtApiDotNet.Win32.ServiceStartType,NtApiDotNet.Win32.ServiceErrorControl,System.String,System.String,NtApiDotNet.OptionalInt32,System.String,System.String,NtApiDotNet.Win32.Security.Native.SecureStringMarshalBuffer,System.String) at 65aeb7eaa825e0bd836cece1d1edfae2-600183b-ServiceUtils~ChangeServiceConfig NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig2(System.String,System.String,NtApiDotNet.Win32.SERVICE_CONFIG_INFO_LEVEL,NtApiDotNet.Win32.SERVICE_DELAYED_AUTO_START_INFO,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001847-ServiceUtils~SetServiceDelayedAutoStart NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig2(System.String,System.String,NtApiDotNet.Win32.SERVICE_CONFIG_INFO_LEVEL,NtApiDotNet.Win32.SERVICE_FAILURE_ACTIONS,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600184b-ServiceUtils~SetServiceFailureActions NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig(System.String,System.String,System.String,System.Nullable`1,System.Nullable`1,System.Nullable`1,System.String,System.Nullable`1,System.String,System.Collections.Generic.IEnumerable`1,System.String,System.Security.SecureString) at 65aeb7eaa825e0bd836cece1d1edfae2-600183e-ServiceUtils~ChangeServiceConfig NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig2(System.String,System.String,NtApiDotNet.Win32.SERVICE_CONFIG_INFO_LEVEL,NtApiDotNet.Win32.SERVICE_REQUIRED_PRIVILEGES_INFO,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600184f-ServiceUtils~SetServiceRequiredPrivileges NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig(System.String,System.String,System.String,System.Nullable`1,System.Nullable`1,System.Nullable`1,System.String,System.Nullable`1,System.String,System.Collections.Generic.IEnumerable`1,System.String,System.Security.SecureString,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600183c-ServiceUtils~ChangeServiceConfig NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig2(System.String,System.String,NtApiDotNet.Win32.SERVICE_CONFIG_INFO_LEVEL,System.Runtime.InteropServices.SafeBuffer,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001802-ServiceUtils~ChangeServiceConfig2T NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig2(System.String,System.String,NtApiDotNet.Win32.SERVICE_CONFIG_INFO_LEVEL,NtApiDotNet.Win32.SERVICE_LAUNCH_PROTECTED_INFO,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001853-ServiceUtils~SetServiceLaunchProtected NtApiDotNet.Win32.ServiceUtils::ChangeServiceConfig2(System.String,System.String,NtApiDotNet.Win32.SERVICE_CONFIG_INFO_LEVEL,NtApiDotNet.Win32.SERVICE_SID_INFO,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001843-ServiceUtils~SetServiceSidType NtApiDotNet.Win32.Win32NativeMethods::ChangeServiceConfig2(NtApiDotNet.Win32.SafeHandles.SafeServiceHandle,NtApiDotNet.Win32.SERVICE_CONFIG_INFO_LEVEL,System.Runtime.InteropServices.SafeBuffer) at 65aeb7eaa825e0bd836cece1d1edfae2-6001801-ServiceUtils~ChangeServiceConfig23a:T957,NtApiDotNet.NtSystemCalls::NtUnloadDriver(NtApiDotNet.UnicodeString) at 65aeb7eaa825e0bd836cece1d1edfae2-6000f8f-NtSystemInfo~UnloadDriver NtApiDotNet.NtFile::DeviceIoControl(NtApiDotNet.NtIoControlCode,System.Runtime.InteropServices.SafeBuffer,System.Runtime.InteropServices.SafeBuffer,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000752-NtFile~DeviceIoControl NtApiDotNet.NtFile::DeviceIoControlAsync(NtApiDotNet.NtIoControlCode,System.Runtime.InteropServices.SafeBuffer,System.Runtime.InteropServices.SafeBuffer,System.Threading.CancellationToken,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000743-NtFile~DeviceIoControlAsync NtApiDotNet.NtFile::DeviceIoControl(NtApiDotNet.NtIoControlCode,System.Runtime.InteropServices.SafeBuffer,System.Runtime.InteropServices.SafeBuffer,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002e67-MountPointManagerUtils~QueryMountPoints NtApiDotNet.NtFile::DeviceIoControl(NtApiDotNet.NtIoControlCode,System.Byte[],System.Int32,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000754-NtFile~DeviceIoControl NtApiDotNet.NtFile::DeviceIoControlAsync(NtApiDotNet.NtIoControlCode,System.Byte[],System.Int32,System.Threading.CancellationToken,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6000744-NtFile~DeviceIoControlAsync NtApiDotNet.NtFile::DeviceIoControlAsync(NtApiDotNet.NtIoControlCode,System.Byte[],System.Int32,System.Threading.CancellationToken,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600074e-NtFile~DeviceIoControlAsync NtApiDotNet.NtSystemCalls::NtLoadDriver(NtApiDotNet.UnicodeString) at 65aeb7eaa825e0bd836cece1d1edfae2-6000f8e-NtSystemInfo~LoadDriver NtApiDotNet.NtFile::DeviceIoControlAsync(NtApiDotNet.NtIoControlCode,System.Runtime.InteropServices.SafeBuffer,System.Runtime.InteropServices.SafeBuffer,System.Threading.CancellationToken,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600074d-NtFile~DeviceIoControlAsync NtApiDotNet.NtFile::DeviceIoControlAsync(NtApiDotNet.NtIoControlCode,System.Byte[],System.Int32,System.Threading.CancellationToken) at 65aeb7eaa825e0bd836cece1d1edfae2-600074a-NtFile~DeviceIoControlAsync NtApiDotNet.NtFile::DeviceIoControlAsync(NtApiDotNet.NtIoControlCode,System.Runtime.InteropServices.SafeBuffer,System.Runtime.InteropServices.SafeBuffer,System.Threading.CancellationToken) at 65aeb7eaa825e0bd836cece1d1edfae2-6000749-NtFile~DeviceIoControlAsync3b:T925,NtApiDotNet.NtDesktop::Create(NtApiDotNet.ObjectAttributes,System.String,NtApiDotNet.DEVMODE,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights,System.Int32,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600064f-NtDesktop~Create NtApiDotNet.NtSystemCalls::NtUserCreateDesktopEx(NtApiDotNet.ObjectAttributes,NtApiDotNet.UnicodeString,NtApiDotNet.DEVMODE,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights,System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-600064d-NtDesktop~Create NtApiDotNet.NtSystemCalls::NtUserCreateWindowStation(NtApiDotNet.ObjectAttributes,NtApiDotNet.WindowStationAccessRights,NtApiDotNet.SafeKernelObjectHandle,System.IntPtr,System.IntPtr,System.Runtime.InteropServices.SafeBuffer,NtApiDotNet.UnicodeString,System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-600136a-NtWindowStation~Create NtApiDotNet.Win32.Win32NativeMethods::CreateWindowStation(System.String,System.Int32,NtApiDotNet.AccessMask,NtApiDotNet.Win32.SECURITY_ATTRIBUTES) at 65aeb7eaa825e0bd836cece1d1edfae2-60019e7-Win32Utils~CreateWindowStation NtApiDotNet.NtDesktop::Create(NtApiDotNet.ObjectAttributes,System.String,NtApiDotNet.DEVMODE,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights,System.Int32,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600064e-NtDesktop~Create NtApiDotNet.NtSystemCalls::NtUserOpenDesktop(NtApiDotNet.ObjectAttributes,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-6000649-NtDesktop~Open NtApiDotNet.NtDesktop::Open(NtApiDotNet.ObjectAttributes,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6001371-NtWindowStation~GetAccessibleDesktops NtApiDotNet.NtDesktop::Open(NtApiDotNet.ObjectAttributes,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600064a-NtDesktop~Open NtApiDotNet.NtDesktop::Open(NtApiDotNet.ObjectAttributes,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-600064b-NtDesktop~Open NtApiDotNet.NtDesktop::Open(NtApiDotNet.ObjectAttributes,NtApiDotNet.CreateDesktopFlags,NtApiDotNet.DesktopAccessRights,System.Boolean) at 65aeb7eaa825e0bd836cece1d1edfae2-6002f25-NtDesktopNtTypeFactoryImpl~OpenInternal18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790313646127,"unified_at":"2026-09-25T05:20:46.127Z","metadata":{"hashes":{"sha256":"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7","sha1":"99c457514fe70836fee2c1734a61acb6c579baff","md5":"65aeb7eaa825e0bd836cece1d1edfae2","sha512":"a2ec2fb2d9e09e446ebb6322edc5065d19f970fbb38972a807b18505edb138e81c0709542f1461b872e71550f5132d343d81647d1c3f2c3f4c8003481b450f7b","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"payload1dec.bin.exe","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":6905344,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1741263038000,"last_seen":1741266094000,"last_multi_scan":1741266094000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["rat","njrat"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":81,"suspicious_count":11,"malicious_count":6,"total":98},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.GenKryptik.hfvx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Kryptik.zovqn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.178053","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.178053 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GenKryptik.HFVX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Kryptik.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c1bb41 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MSIL-AX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/S-d8642ed3!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.MSILZilla","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"malicious","value":"Contains ability to change service configuration"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"malicious","value":"Contains ability to modify user account rights"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Contains ability to open the access token associated with a process"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"suspicious","value":"Checks a device property (often used to detect VM artifacts)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Sample/File contains another embedded binary"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"suspicious","value":"Contains ability to capture credentials"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"b__0\" (Indicator: \"OpenThreadToken\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"b__0\" (Indicator: \"OpenProcessToken\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"FwpmFreeMemory0\" (Indicator: \"FreeMemory\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrarySearchSystem32\" (Indicator: \"LoadLibrary\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2\" (Indicator: \"ChangeServiceConfig\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$22","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.0852206312512305","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"b__153_0\" (Indicator: \"GetCommandLine\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"b__0\" (Indicator: \"sendmessage\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004912)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$23","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000380061006200650037003600380034003500370066003200320062003500300035003000320039006600300064003800660064003700390032003000340035003400330064006300330030006200300062006300370062006400360033003500630036006100370064006300650037002e006500780065000000507f33f2 (UID: 00000000-00004912)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"NtApiDotNet.NtRtl::RtlGetVersion(NtApiDotNet.RTL_OSVERSIONINFOEXW&) at 65aeb7eaa825e0bd836cece1d1edfae2-6000f4d-NtSystemInfo~GetOSVersion\n NtApiDotNet.NtObjectUtils::GetVersion() at 65aeb7eaa825e0bd836cece1d1edfae2-6002208-RpcClientBuilder~AddServerComment","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"b__290_0\" (Indicator: \"GetCreationTime\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"b__291_0\" (Indicator: \"GetLastWriteTime\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"b__293_0\" (Indicator: \"GetLastAccessTime\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$24","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" queries volume information of \"C:\\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" at 00000000-00004912-00000C15-1279995170","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$25","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"b__0\" (Indicator: \"CreateProcess\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"LsaLookupSids2\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API (Indicator: \"LsaLookupNames2\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API (Indicator: \"RtlIsNameLegalDOS8Dot3\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API (Indicator: \"SendMessageA\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API (Indicator: \"PostMessageA\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API (Indicator: \"CreateFileA\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API (Indicator: \"ServicesActive\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"b__0\" (Indicator: \"LogonUser\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule64\" (Indicator: \"LoadModule\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"b__153_0\" (Indicator: \"GetCommandLine\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"b__0\" (Indicator: \"OpenThread\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"b__0\" (Indicator: \"OpenProcess\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\~\" in Source: 00000000-00004912.00000000.144999.F2320000.00000004.mdmp\n \"Y\\MACHINE\\Software\\Microsoft\\StrongName\\RevokedKeys\" in Source: 00000000-00004912.00000000.144999.F2320000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\" in Source: 00000000-00004912.00000000.144999.F2320000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$28","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 41B50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 71660000\n \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 70E10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 43150000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 72B10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c78571fb7f0000@ntdll.dll\"\n \"220023000000000018c78571fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" was detected as \".NET\" and name: \"Library\"\n \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" queries basic process information of the \"C:\\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (UID: 4912)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect presence of virtualization software","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"b__0\" (Indicator: \"CreateNamedPipe\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"&*.sz\"\n Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"\n Pattern match: \"microsoft.net/framework64/v4.0.30319/\"\n Heuristic match: \"oft.as\"\n Heuristic match: \"ystem.windows.fo\"\n Heuristic match: \"tem.co\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity","description":"NtApiDotNet.Win32.Win32NativeMethods::WTSFreeMemoryEx(NtApiDotNet.Win32.WTS_TYPE_CLASS,System.IntPtr,System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-60019eb-Win32Utils~GetConsoleSessions\n NtApiDotNet.Win32.Win32NativeMethods::WTSFreeMemory(System.IntPtr) at 65aeb7eaa825e0bd836cece1d1edfae2-6001879-TokenUtils~GetSessionTokens","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1021.001","relevance":5,"id":"stream-137","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information","description":"NtApiDotNet.Win32.Win32NativeMethods::WTSEnumerateSessionsEx(System.IntPtr,System.Int32&,System.Int32,System.IntPtr&,System.Int32&) at 65aeb7eaa825e0bd836cece1d1edfae2-60019eb-Win32Utils~GetConsoleSessions\n NtApiDotNet.Win32.Win32NativeMethods::WTSQueryUserToken(System.Int32,NtApiDotNet.SafeKernelObjectHandle&) at 65aeb7eaa825e0bd836cece1d1edfae2-6001878-TokenUtils~GetSessionToken\n NtApiDotNet.Win32.Win32NativeMethods::WTSEnumerateSessions(System.IntPtr,System.Int32,System.Int32,System.IntPtr&,System.Int32&) at 65aeb7eaa825e0bd836cece1d1edfae2-6001879-TokenUtils~GetSessionTokens","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1018","relevance":5,"id":"stream-138","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" called \"GetComputerNameW\" (UID: 00000000-00004912)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"b__0\" (Indicator: \"CreateMailslot\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"b__4_0\" (Indicator: \"GetProcAddress\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"b__288_0\" (Indicator: \"GetFileAttributes\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"b__52_0\" (Indicator: \"GetProcessId\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"b__92_0\" (Indicator: \"GetProcessId\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"b__54_0\" (Indicator: \"GetProcessId\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"b__0\" (Indicator: \"GetEnvironmentVariable\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 65aeb7eaa825e0bd836cece1d1edfae2-600008e-JavasetAsBstr~IsLittleEndianCausalityRelation","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"b__3_0\" (Indicator: \"LookupAccountSid\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"b__0\" (Indicator: \"OpenProcessToken\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"LsaLookupSids2\" (Indicator: \"LsaLookupSids\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"b__0\" (Indicator: \"OpenProcess\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004912-00000C29-1279171500\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004912-00000C29-1281214565\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004912.00000000.144999.F2320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"b__0\" (Indicator: \"CreateProcessWithLogon\"; File: \"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Checks a device property (often used to detect VM artifacts)","description":"NtApiDotNet.Win32.Device.DeviceNativeMethods::SetupDiGetClassDevsW(NtApiDotNet.OptionalGuid,System.String,System.IntPtr,NtApiDotNet.Win32.Device.DiGetClassFlags) at 65aeb7eaa825e0bd836cece1d1edfae2-60025b6-DeviceUtils~GetDeviceList","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1480","relevance":7,"id":"stream-30","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4912)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"$35","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1007","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to open the access token associated with a process","description":"NtApiDotNet.NtSystemCalls::NtOpenProcessTokenEx(NtApiDotNet.SafeKernelObjectHandle,NtApiDotNet.TokenAccessRights,NtApiDotNet.AttributeFlags,NtApiDotNet.SafeKernelObjectHandle&) at 65aeb7eaa825e0bd836cece1d1edfae2-6001179-NtToken~OpenProcessToken","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134","relevance":3,"id":"stream-93","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$37","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$38","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture credentials","description":"NtApiDotNet.Win32.Security.Native.SecurityNativeMethods::CredEnumerate(System.String,NtApiDotNet.Win32.Security.Credential.CredentialEnumerateFlags,System.Int32&,NtApiDotNet.Win32.SafeHandles.SafeCredBuffer&) at 65aeb7eaa825e0bd836cece1d1edfae2-6001c2b-CredentialManager~GetCredentials","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1555.004","relevance":7,"id":"stream-68","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at 65aeb7eaa825e0bd836cece1d1edfae2-600006a-JavasetAsBstr~AddOvfLocalAuthority\n System.Diagnostics.Process::GetProcessesByName(System.String) at 65aeb7eaa825e0bd836cece1d1edfae2-6000059-JavasetAsBstr~TokenHashValuegetPermissionSet\n NtApiDotNet.Win32.Win32NativeMethods::EnumProcessModulesEx(NtApiDotNet.SafeKernelObjectHandle,System.IntPtr[],System.Int32,System.Int32&,NtApiDotNet.Win32.Debugger.EnumProcessModulesFilter) at 65aeb7eaa825e0bd836cece1d1edfae2-6002607-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"NtApiDotNet.Win32.TokenUtils::OpenClipboardToken(NtApiDotNet.TokenAccessRights) at 65aeb7eaa825e0bd836cece1d1edfae2-600186f-TokenUtils~GetTokenFromClipboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Sample/File contains another embedded binary","description":"Found multiple string (Indicator: This program cannot be run in DOS mode) in file /tmp/e4769c5c-22d3-4bfa-8f91-9714e5f384d7/sample.bin at offset 3097191","origin":"Binary File","mitre_attack_id":"T1027.009","relevance":3,"id":"binary-64","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"malicious","category":"General","name":"Contains ability to change service configuration","description":"$39","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543.003","relevance":5,"id":"stream-73","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"malicious","category":"Installation/Persistence","name":"Contains ability to modify user account rights","description":"NtApiDotNet.Win32.Security.Native.SecurityNativeMethods::LsaAddAccountRights(NtApiDotNet.Win32.SafeHandles.SafeLsaHandle,NtApiDotNet.SafeSidBufferHandle,NtApiDotNet.UnicodeStringIn[],System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-6001b0f-LsaPolicy~AddAccountRights\n NtApiDotNet.Win32.Security.Native.SecurityNativeMethods::LsaRemoveAccountRights(NtApiDotNet.Win32.SafeHandles.SafeLsaHandle,NtApiDotNet.SafeSidBufferHandle,System.Boolean,NtApiDotNet.UnicodeStringIn[],System.Int32) at 65aeb7eaa825e0bd836cece1d1edfae2-6001b11-LsaPolicy~RemoveAccountRights","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":7,"id":"stream-19","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"win_exe_njRAT\" classified file \"sample.bin\" as \"rat,njrat\" (Author: info@fidelissecurity.com)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop","description":"$3b","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Contains ability to create/switch the desktop"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Contains ability to capture credentials"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Checks a device property (often used to detect VM artifacts)"},{"detail":"Contains ability to change service configuration"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Contains ability to do process injection (Process Doppelganging)"}],"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":42,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["rat","njrat"],"sample_flags":["Sample Crashed"],"sandbox_reports":[{"id":"67c99cadf4ba43746403dad1","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe","analysis_start_time":"2025-03-06T13:01:34+00:00","indicators_count":{"informative":82,"suspicious":32,"malicious":6},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}],"processes":[{"pid":4912,"ppid":0,"name":"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe","command_line":"","sha256":"2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7","normalized_path":"C:\\2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7.exe","uid":"00000000-00004912","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3916,"ppid":4912,"name":"WerFault.exe","command_line":"-u -p 4912 -s 780","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004912","uid":"00000000-00003916"},{"pid":8024,"ppid":4912,"name":"WerFault.exe","command_line":"-u -p 4912 -s 780","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00004912","uid":"00000000-00008024"},{"pid":4572,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 4912 -ip 4912","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004572","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["user32.dll","sechost.dll","oleaut32.dll","mscoreei.dll","kernel.appcore.dll","gdi32full.dll","kernel32.dll","fltLib.dll","KernelBase.dll","msvcrt.dll","combase.dll","mscorlib.ni.dll","clrjit.dll","System.ni.dll","System.Management.ni.dll","rsaenh.dll","bcryptprimitives.dll","shlwapi.dll","psapi.dll","diasymreader.dll","cryptbase.dll","ucrtbase.dll","advapi32.dll","cryptsp.dll","version.dll","win32u.dll","gdi32.dll","apphelp.dll","ws2_32.dll","ntdll.dll","imm32.dll","rpcrt4.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","VxSSL64.dll","ole32.dll","System.ServiceProcess.ni.dll","mscoree.dll","msvcp_win.dll","clr.dll","bcrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"67c99cadf4ba43746403dad1"}]}]}},"report_ids":{"sandbox_job_ids":["67c99cadf4ba43746403dad1"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious IL:Trojan.MSILZilla Sample 2acb08478abe… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2acb08478abe…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 11/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.MSILZilla Sample 2acb08478abe… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2acb08478abe…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 11/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2acb08478abe768457f22b505029f0d8fd79204543dc30b0bc7bd635c6a7dce7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.MSILZilla Sample 2acb08478abe… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2acb08478abe…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 11/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]