24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 49:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.PasswordStealerA.Generic Sample 37fa30c9dcf2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 37fa30c9dcf2…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","keywords":["Malicious","MSIL.PasswordStealerA.Generic","malware analysis","sandbox report","threat intelligence","37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf"],"about":{"@type":"SoftwareApplication","name":"bounty-8142015804568623","applicationCategory":["peexe","assembly","executable"],"identifier":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.PasswordStealerA.Generic","antivirusDetections":{"malicious":21,"total":25},"behavioralIndicators":{"malicious":11,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta53,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "WriteDateTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "WriteDateTime" (Indicator: "write"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "set_LastAccessTimeUtc" (Indicator: "access"; Source: "sample.bin"), Found reference to API "set_LastAccessTimeUtc" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ExitThread" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "ExitThread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteObjectContent" (Indicator: "write"; Source: "sample.bin"), Found reference to API "GetConnectionsResponse" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "get_IsConnected" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "OpenReadonlySubKeySafe" (Indicator: "open"; Source: "sample.bin"), Found reference to API "OpenReadonlySubKeySafe" (Indicator: "read"; Source: "sample.bin"), Found reference to API "TryReadUInt64Variant" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "WriteDuration" (Indicator: "write"; Source: "sample.bin"), Found reference to API "DirectReadLittleEndianInt32" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteUInt64" (Indicator: "write"; Source: "sample.bin"), Found reference to API "writePacked" (Indicator: "write"; Source: "sample.bin"), Found reference to API "WriteSerializers" (Indicator: "write"; Source: "sample.bin"), Found reference to API "Cannot write a " (Indicator: "write"; Source: "sample.bin"), Found reference to API "GetStaticMethod" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "CloseDesktop" (Indicator: "close"; Source: "sample.bin"), Found reference to API "SetSuspendState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeTypeModel" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Log created on " (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateBuilder" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "get_HasExited" (Indicator: "exit"; Source: "sample.bin")26:T1022,Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "CloseDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "ToAscii"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKeyEx"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfo"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterHotKey"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterHotKey"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDC"; Source: "sample.bin"), Found reference to API (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "PostMessage"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ToUnicodeEx"; Source: "sample.bin"), Found reference to API (Indicator: "EnumDesktopWindows"; Source: "sample.bin"), Found reference to API (Indicator: "ExtractAssociatedIcon"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardState"; Source: "sample.bin"), Found reference to API (Indicator: "CryptAcquireContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardLayout"; Source: "sample.bin"), Found reference to API (Indicator: "QueueUserWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "OpenDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastInputInfo"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendInput"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "GetExtendedTcpTable"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin")27:T58a,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "sample.bin"), Found string "CryptoStream" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "sample.bin"), Found string "ReadContentAsBase64" (Indicator: "base64"; Source: "sample.bin"), Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "sample.bin"), Found string "WriteBase64" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "sample.bin")28:T5cc,Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "sample.bin"), Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "sample.bin"), Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "sample.bin"), Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "sample.bin"), Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "sample.bin"), Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "sample.bin"), Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "sample.bin"), Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "sample.bin"), Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "sample.bin")29:Tb6c,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Realtek HD Audio Universal Services.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "Realtek HD Audio Universal Services.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Realtek HD Audio Universal Services.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Realtek HD Audio Universal Services.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Realtek HD Audio Universal Services.exe"2a:T9d6,"Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-2169607 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-2169878 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4514613 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4515011 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4521263 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4521554 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4524823 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4525015 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4528166 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4528347 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4531644 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4531831 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4534923 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4535101 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4538971 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4539155 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4542499 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4542679 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4545829 [PID: 4348] "Realtek HD Audio Universal Services.exe" queried SystemProcessInformation at 00000000-00004348-00000105-4546008 [PID: 4348]2b:T711,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Dotnet file contains encryption/decryption functions2c:T80e,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000250a346000c73007f00000000000000000000000080000000000000000c73007f887747000100000000000000020000000c000000c82e4700c82e4700c32e47000000000000000000000042000000000170f530000000000090fb300095e114778e932900feffffff435c18775059187794000000a0000000c22e4700c02e47009400000014f73000fdfe9a75f4ef30000100000090fb300092e0406b83288899feffffffacf630004c9c406b5c0c0000c0f630005f9c406b0000000000000000 (UID: 00000000-00005412)2d:T851,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300600b4600110000114d830000f892470050a34600b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebc475505a4f0000a0fd7f9a5c197700f0fd7f30e4300044a0fd7f00000000400000003f0000001d00000000a0fd7f24e43000c15c1977608220771d00000000a0fd7f9a5c197700f0fd7f48e43000578918778083207713170a75d8ebc475 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000fa6501770000c1750000000000000000f000c17502000000000000008800000095e1147764e43000459d2d7700005e00000000008000000002000000000031009c1d5a7378e430006c225a7380000000d3225a73dcf05a7394e43000741d5a73dcf05a7300000000c4e5300000000000 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000266501770000c1750000000000000000f000c17502000000000000008800000095e1147788e43000459d2d7700005e00000000008000000002000000000031009c1d5a739ce430006c225a7380000000d3225a73dcf05a73b8e43000741d5a73dcf05a7300000000e8e5300000000000 (UID: 00000000-00005412) "Realtek HD Audio Universal Services.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000024000000020000000000000000000000e2a62d001100000000000000000000002200000000000000000000000f00010eb1b2000e63006f006e00660069006700750072006100740069006f006e0000005c0048004100500055004200570053005c004100700070004400610074006100 (UID: 00000000-00004348)2e:T4d5,Found string "SELECT * FROM Win32_BIOS" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SELECT * FROM Win32_DisplayConfiguration" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf")2f:T68c,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "Realtek HD Audio Universal Services.exe"30:T465d,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter certcli.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dsrole.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter crypt32 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005412) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003848) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WTSAPI32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004348)31:Tfd8b,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptFindOIDInfoW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CAOIDGetLdapURL (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CAOIDFreeLdapURL (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DsRoleGetPrimaryDomainInformation (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DsRoleFreeMemory (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptDecodeObjectW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CryptVerifySignatureW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter PostThreadMessage (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005412) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003848) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003848) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003848) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003848) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003848) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter WTSEnumerateProcessesW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004348) "Realtek HD Audio Universal Services.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004348)32:T460,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKeyTree" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "Realtek HD Audio Universal Services.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKeyTree" in "Realtek HD Audio Universal Services.exe"33:T1382,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WTSAPI32.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "Realtek HD Audio Universal Services.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]34:Tb53,Observed unmanaged function "LoadLibrary" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "FreeLibrary" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "GetProcAddress" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "QueryFullProcessImageName" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "BitBlt" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "CreateDC" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "DeleteDC" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "GetLastInputInfo" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "SetCursorPos" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "GetMessageExtraInfo" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "SendInput" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "SystemParametersInfo" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "PostMessage" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "OpenDesktop" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "CloseDesktop" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "EnumDesktopWindows" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "IsWindowVisible" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "GetForegroundWindow" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "GetWindowText" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "GetExtendedTcpTable" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "SetTcpEntry" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "CryptAcquireContext" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "CryptCreateHash" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "CryptHashData" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed unmanaged function "CryptDestroyHash" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf"35:T1612,"Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocolteEKUsponseHandli" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004348.00000000.76028.01D40000.00000004.mdmp "pera Software\Opera Stable\Login Data" in Source: 00000000-00004348.00000002.79872.010B2000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsingositionserimResponseHandli" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005412.00000000.71739.019F0000.00000004.mdmp "pera Software\Opera Stable\Login Data" in Source: 00000000-00005412.00000002.75586.00D62000.00000020.mdmp36:T2b54,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70a60000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "KERNEL32" at base 75960000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "ADVAPI32.DLL" at base 75f40000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b730000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "SHLWAPI.DLL" at base 76080000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "VERSION.DLL" at base 744d0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 640e0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "USER32.DLL" at base 753a0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "MSCOREE.DLL" at base 6b7c0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "PSAPI.DLL" at base 75a40000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "RPCRT4.DLL" at base 760e0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "KERNEL32.DLL" at base 75960000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62cd0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "OLE32.DLL" at base 756b0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "CRYPTBASE.DLL" at base 74f30000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73af0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 723b0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69390000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62270000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69450000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61400000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73e60000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60be0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69280000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60460000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "NTDLL.DLL" at base 77130000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "SHELL32.DLL" at base 76230000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77280000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "PROFAPI.DLL" at base 75040000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "BCRYPT.DLL" at base 74b50000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "CRYPTSP.DLL" at base 74a40000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 747d0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "UXTHEME.DLL" at base 73af0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "COMCTL32.DLL" at base 73f00000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "GDI32.DLL" at base 75a60000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "DWMAPI.DLL" at base 73c90000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "CRYPT32.DLL" at base 750e0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70c00000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "CRYPTNET.DLL" at base 70c00000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "SENSAPI.DLL" at base 726a0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "CERTCLI.DLL" at base 6ae90000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\SYSTEM32\DSROLE.DLL" at base 73590000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "CRYPT32" at base 750e0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "CERTCLI.DLL" at base 6ae30000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "SSPICLI.DLL" at base 74ec0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ee0000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77280000 "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" loaded module "RPCRTREMOTE.DLL" at base 74fd0000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6aa40000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73640000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74ec0000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75f40000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73860000 "Realtek HD Audio Universal Services.exe" loaded module "VERSION.DLL" at base 744d0000 "Realtek HD Audio Universal Services.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70a60000 "Realtek HD Audio Universal Services.exe" loaded module "KERNEL32" at base 75960000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 63930000 "Realtek HD Audio Universal Services.exe" loaded module "USER32.DLL" at base 753a0000 "Realtek HD Audio Universal Services.exe" loaded module "MSCOREE.DLL" at base 6b7c0000 "Realtek HD Audio Universal Services.exe" loaded module "PSAPI.DLL" at base 75a40000 "Realtek HD Audio Universal Services.exe" loaded module "WTSAPI32.DLL" at base 733e0000 "Realtek HD Audio Universal Services.exe" loaded module "KERNEL32.DLL" at base 75960000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62520000 "Realtek HD Audio Universal Services.exe" loaded module "WINSTA.DLL" at base 74fa0000 "Realtek HD Audio Universal Services.exe" loaded module "OLE32.DLL" at base 756b0000 "Realtek HD Audio Universal Services.exe" loaded module "CRYPTBASE.DLL" at base 74f30000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73af0000 "Realtek HD Audio Universal Services.exe" loaded module "RPCRT4.DLL" at base 760e0000 "Realtek HD Audio Universal Services.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73e60000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6ae60000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61ac0000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6acb0000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 60c50000 "Realtek HD Audio Universal Services.exe" loaded module "ADVAPI32.DLL" at base 75f40000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72690000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60430000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a890000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64110000 "Realtek HD Audio Universal Services.exe" loaded module "NTDLL.DLL" at base 77130000 "Realtek HD Audio Universal Services.exe" loaded module "SHELL32.DLL" at base 76230000 "Realtek HD Audio Universal Services.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77280000 "Realtek HD Audio Universal Services.exe" loaded module "PROFAPI.DLL" at base 75040000 "Realtek HD Audio Universal Services.exe" loaded module "BCRYPT.DLL" at base 74b50000 "Realtek HD Audio Universal Services.exe" loaded module "CRYPTSP.DLL" at base 74a40000 "Realtek HD Audio Universal Services.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 747d0000 "Realtek HD Audio Universal Services.exe" loaded module "UXTHEME.DLL" at base 73af0000 "Realtek HD Audio Universal Services.exe" loaded module "COMCTL32.DLL" at base 73f00000 "Realtek HD Audio Universal Services.exe" loaded module "GDI32.DLL" at base 75a60000 "Realtek HD Audio Universal Services.exe" loaded module "DWMAPI.DLL" at base 73c9000037:T963,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Realtek HD Audio Universal Services.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"38:Tf8b,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005412-00000C2B-128153994] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005412-00000C2B-128498314] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005412-00000C2B-129533141] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005412-00000C2B-129664685] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005412-00000C2B-129895436] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005412-00000C2B-129958790] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005412-00000C2B-130086303] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005412-00000C2B-130439192] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005412-00000C2B-130513058] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005412-00000C2B-130653290] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005412-00000C2B-130774427] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005412-00000C2B-130978120] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005412-00000C2B-131049120] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005412-00000C2B-131109909] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005412-00000C2B-131182172] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005412-00000C2B-131553398] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005412-00000C2B-131991691] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005412-00000C2B-132439014] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005412-00000C2B-133045538] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005412-00000C2B-190393752] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00005412-00000C2B-190591352] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00005412-00000C2B-191122946] Observed system executable string:"%WINDIR%\system32\dsrole.dll" [Source: 00000000-00005412-00000C2B-192488751] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WTSAPI32.dll" [Source: 00000000-00004348-00000C2B-195721317] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004348-00000C2B-196141547]39:Ta00,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "")3a:Tfec,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "37FA30C9DCF255BDA62C0A6B7F88A48263A3DA18D18D8C66B1CBBC801077CFDF"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "CACHELOCATION"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DOWNLOADCACHEQUOTAINKB"; Value: "") "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "ENABLELOG"; Value: "")3b:T6e5,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"3c:Tcfc,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\FLTLIB.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\MSVCP140.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\VCRUNTIME140.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\ucrtbase.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"3d:Tcf7,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\FLTLIB.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\MSVCP140.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\ucrtbase.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"3e:Tbdb,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe.config" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Client\" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.INI" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe.Local\" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe:Zone.Identifier" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Realtek HD Audio Universal Services\Realtek HD Audio Universal Services.exe:Zone.Identifier" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37FA30C9DCF255BDA62C0A6B7F88A48263A3DA18D18D8C66B1CBBC801077CFDF.EXE.CONFIG" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\CLIENT" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37FA30C9DCF255BDA62C0A6B7F88A48263A3DA18D18D8C66B1CBBC801077CFDF.INI" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37FA30C9DCF255BDA62C0A6B7F88A48263A3DA18D18D8C66B1CBBC801077CFDF.EXE.LOCAL" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe:ZONE.IDENTIFIER" "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\REALTEK HD AUDIO UNIVERSAL SERVICES"3f:Tda8,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "IOControl" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_OSSupportsIPv6" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "Realtek HD Audio Universal Services.exe"40:T9d7,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "Realtek HD Audio Universal Services.exe"41:T684,Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "Realtek HD Audio Universal Services.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "Realtek HD Audio Universal Services.exe"42:T618,Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00004348.00000000.76028.01D40000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004348.00000000.76028.01D40000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004348.00000000.76028.01D40000.00000004.mdmp") Found URL "https://stackoverflow.com/q/2152978/23354annot" - Source: "00000000-00004348.00000002.79872.010B2000.00000020.mdmp") Found URL "https://stackoverflow.com/q/11564914/23354;" - Source: "00000000-00004348.00000002.79872.010B2000.00000020.mdmp") Found URL "https://stackoverflow.com/q/14436606/23354t" - Source: "00000000-00004348.00000002.79872.010B2000.00000020.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00005412.00000000.71739.019F0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005412.00000000.71739.019F0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005412.00000000.71739.019F0000.00000004.mdmp") Found URL "https://stackoverflow.com/q/2152978/23354annot" - Source: "00000000-00005412.00000002.75586.00D62000.00000020.mdmp") Found URL "https://stackoverflow.com/q/11564914/23354;" - Source: "00000000-00005412.00000002.75586.00D62000.00000020.mdmp") Found URL "https://stackoverflow.com/q/14436606/23354t" - Source: "00000000-00005412.00000002.75586.00D62000.00000020.mdmp")43:T4f2,Found string "b__4_0" (Indicator: "winscp"; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "WinSCP" (Indicator: "winscp"; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" (Indicator: "winscp"; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions" (Indicator: "winscp"; File: "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf") Found string "ARE\\Martin Prikryl\\WinSCP 2\\Sessions" (Indicator: "winscp"; File: "00000000-00005412.00000002.75586.00D62000.00000020.mdmp") Found string "OFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" (Indicator: "winscp"; Source: "00000000-00004348.00000002.79872.010B2000.00000020.mdmp") Found string "b__4_0" (Indicator: "winscp"; Source: "00000000-00004348.00000002.79872.010B2000.00000020.mdmp") Found string "OFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" (Indicator: "winscp"; Source: "00000000-00005412.00000002.75586.00D62000.00000020.mdmp") Found string "b__4_0" (Indicator: "winscp"; Source: "00000000-00005412.00000002.75586.00D62000.00000020.mdmp")44:Teac,"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005412) "37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005412)45:Tdf7,Found string "DeleteDC" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: GDI32.DLL) Found string "CryptHashData" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: CRYPTSP.DLL) Found string "GetCurrentThreadId" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: KERNELBASE.DLL) Found string "GetWindowThreadProcessId" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "IsWindowVisible" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "Rectangle" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: GDI32.DLL) Found string "CompareFileTime" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: KERNELBASE.DLL) Found string "SystemTimeToFileTime" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: KERNELBASE.DLL) Found string "GetDoubleClickTime" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "FileTimeToSystemTime" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: KERNELBASE.DLL) Found string "GetKeyboardState" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "GetKeyState" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "CryptCreateHash" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: CRYPTSP.DLL) Found string "CryptDestroyHash" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: CRYPTSP.DLL) Found string "ToAscii" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "CryptGetHashParam" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: CRYPTSP.DLL) Found string "QueueUserWorkItem" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: KERNEL32.DLL) Found string "GetMessageExtraInfo" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "SHGetFileInfo" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: SHELL32.DLL) Found string "GetSystemInfo" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: KERNELBASE.DLL) Found string "GetLastInputInfo" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "Sleep" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: KERNELBASE.DLL) Found string "memcmp" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: VCRUNTIME140_CLR0400.DLL) Found string "CloseDesktop" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL) Found string "GetSystemMetrics" (Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf, API is part of module: USER32.DLL)46:Te8c,Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a760c4263a2d1e144c2fd116bf1351e1-600096c-ctor Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a760c4263a2d1e144c2fd116bf1351e1-600096f-ctor Gma.System.MouseKeyHook.Implementation.BaseListener::set_Handle(Gma.System.MouseKeyHook.WinApi.HookResult) at a760c4263a2d1e144c2fd116bf1351e1-6000976-ctor Gma.System.MouseKeyHook.Implementation.BaseListener::get_Handle() at a760c4263a2d1e144c2fd116bf1351e1-6000979-BaseListener~Dispose Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a760c4263a2d1e144c2fd116bf1351e1-600097f-ctor Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a760c4263a2d1e144c2fd116bf1351e1-6000982-ctor Gma.System.MouseKeyHook.Implementation.GlobalMouseListener::IsDoubleClick(Gma.System.MouseKeyHook.MouseEventExtArgs) at a760c4263a2d1e144c2fd116bf1351e1-6000983-GlobalMouseListener~ProcessDown Gma.System.MouseKeyHook.Implementation.MouseListener::ProcessUp(Gma.System.MouseKeyHook.MouseEventExtArgs&) at a760c4263a2d1e144c2fd116bf1351e1-6000984-GlobalMouseListener~ProcessUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a760c4263a2d1e144c2fd116bf1351e1-600098c-EventFacade~add_KeyDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a760c4263a2d1e144c2fd116bf1351e1-600098d-EventFacade~remove_KeyDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a760c4263a2d1e144c2fd116bf1351e1-600098e-EventFacade~add_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a760c4263a2d1e144c2fd116bf1351e1-600098f-EventFacade~remove_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a760c4263a2d1e144c2fd116bf1351e1-6000990-EventFacade~add_KeyUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a760c4263a2d1e144c2fd116bf1351e1-6000991-EventFacade~remove_KeyUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000992-EventFacade~add_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000993-EventFacade~remove_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000994-EventFacade~add_MouseMoveExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000995-EventFacade~remove_MouseMoveExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000996-EventFacade~add_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000997-EventFacade~remove_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000998-EventFacade~add_MouseDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-6000999-EventFacade~remove_MouseDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-600099a-EventFacade~add_MouseDownExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-600099b-EventFacade~remove_MouseDownExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a760c4263a2d1e144c2fd116bf1351e1-600099c-EventFacade~add_MouseUp47:Ted2,␻躒ﻋ⭣왿ᗴ謪蓣扑项辆ϛ뒢㣣鄩 ࣐땦ࡵ::set_Handle(System.Net.Sockets.Socket) at a760c4263a2d1e144c2fd116bf1351e1-6000055-ctor System.Net.Sockets.Socket::EndConnect(System.IAsyncResult) at a760c4263a2d1e144c2fd116bf1351e1-6000056-_~_ System.Net.Sockets.Socket::EndReceive(System.IAsyncResult) at a760c4263a2d1e144c2fd116bf1351e1-6000057-_~_ System.Net.Sockets.Socket::Close() at a760c4263a2d1e144c2fd116bf1351e1-6000058-_~_ System.Net.Sockets.Socket::Send(System.Byte[]) at a760c4263a2d1e144c2fd116bf1351e1-6000059-_~_ 䅆봙䊹姟䀽Ǟ꼺헎㎸ᆵ䵝䱛쉄习�콧㩡::SetKeepAliveEx(System.Net.Sockets.Socket,System.UInt32,System.UInt32) at a760c4263a2d1e144c2fd116bf1351e1-6000130-_~_ System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-600033d-Helpers~GetInstanceMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-600033e-Helpers~GetStaticMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at a760c4263a2d1e144c2fd116bf1351e1-600033f-Helpers~GetStaticMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at a760c4263a2d1e144c2fd116bf1351e1-6000340-Helpers~GetInstanceMethod System.Type::GetConstructor(System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at a760c4263a2d1e144c2fd116bf1351e1-600034a-Helpers~GetConstructor System.Type::GetConstructors(System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-600034b-Helpers~GetConstructors System.Type::GetProperty(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-600034c-Helpers~GetProperty System.Type::GetProperties(System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-600034e-Helpers~GetInstanceFieldsAndProperties System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at a760c4263a2d1e144c2fd116bf1351e1-60004ed-DefaultValueDecorator~EmitBeq System.Type::GetProperties(System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-6000560-MapDecorator_3~GetIndexerSetter System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at a760c4263a2d1e144c2fd116bf1351e1-6000582-ParseableSerializer~TryCreate System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at a760c4263a2d1e144c2fd116bf1351e1-6000583-ParseableSerializer~GetCustomToString System.Type::GetMethods(System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-60005d5-SurrogateSerializer~HasCast System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-600061a-EmitWrite System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-6000620-EmitCreateInstance System.Type::GetMembers(System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-60006ac-MetaType~ApplyDefaultBehaviourImpl System.Type::GetMember(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-60006cb-MetaType~AddField System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-600072b-RuntimeTypeModel~Override System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at a760c4263a2d1e144c2fd116bf1351e1-6000730-RuntimeTypeModel~WriteGetKeyImpl48:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791333141564,"unified_at":"2026-10-07T00:32:21.564Z","metadata":{"hashes":{"sha256":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","sha1":"98da7637a98df832078ed0ec08d11d588223783e","md5":"a760c4263a2d1e144c2fd116bf1351e1","sha512":"ee8ff2686a4a95a779711ca3126423f769351de6b9e8a27d0ff0d78212e76ef703ada91778620799dd3dbe07cea840f7f44c65273278ea3b4f539274dbc806bf","ssdeep":"12288:+TEgdfY97axTU7H4TywQCngRnLN9cHcdA:bUwkyoywQCnkgcdA","ssdeep_chunks":["12288:+TEgdfY","12288:TEgdfY9","12288:EgdfY97","12288:gdfY97a","12288:dfY97ax","12288:fY97axT","12288:Y97axTU","12288:97axTU7","12288:7axTU7H","12288:axTU7H4","12288:xTU7H4T","12288:TU7H4Ty","12288:U7H4Tyw","12288:7H4TywQ","12288:H4TywQC","12288:4TywQCn","12288:TywQCng","12288:ywQCngR","12288:wQCngRn","12288:QCngRnL","12288:CngRnLN","12288:ngRnLN9","12288:gRnLN9c","12288:RnLN9cH","12288:nLN9cHc","12288:LN9cHcd","12288:N9cHcdA","24576:+TEgdfY","24576:TEgdfY9","24576:EgdfY97","24576:gdfY97a","24576:dfY97ax","24576:fY97axT","24576:Y97axTU","24576:97axTU7","24576:7axTU7H","24576:axTU7H4","24576:xTU7H4T","24576:TU7H4Ty","24576:U7H4Tyw","24576:7H4TywQ","24576:H4TywQC","24576:4TywQCn","24576:TywQCng","24576:ywQCngR","24576:wQCngRn","24576:QCngRnL","24576:CngRnLN","24576:ngRnLN9","24576:gRnLN9c","24576:RnLN9cH","24576:nLN9cHc","24576:LN9cHcd","24576:N9cHcdA","12288:bUwkyoy","12288:Uwkyoyw","12288:wkyoywQ","12288:kyoywQC","12288:yoywQCn","12288:oywQCnk","12288:ywQCnkg","12288:wQCnkgc","12288:QCnkgcd","12288:CnkgcdA"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"fb2c37a3aa240d0fdd556c6c16a856fcfc849607"},"file_info":{"file_name":"bounty-8142015804568623","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":515072,"entropy":6.16,"compile_timestamp":"2020-06-05T15:48:38","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1717812411000,"last_seen":1788099922000,"last_multi_scan":1788099922000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":509988,"raw_size":510464},{"name":".rsrc","virtual_address":"0x80000","virtual_size":3176,"raw_size":3584},{"name":".reloc","virtual_address":"0x82000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","rat","quasar","opensource","targeted","criminal","infostealer","evasive"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":193,"suspicious_count":18,"malicious_count":11,"total":222},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.QuasarRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Quasar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Quasar.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.PasswordStealerA.9D949BBD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Generic-9883082-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.PasswordStealerA.9D949BBD (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Keylogger.DQJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Quasar.gen.dwzd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Quasar.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0056b6611 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Quasar-AF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.DN-Quasar.515072.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"PWS-FDEK!A760C4263A2D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.BTX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MulDrop13.PUA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Keylogger.Win32.83293","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL.PasswordStealerA.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Quasar","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"BLIND SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Systemd Timers","attack_id":"T1053.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/006","identifiers":[{"type":"informative","value":"Able to access scheduled job timer"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to obtain MAC address in .NET file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dotnet code contains ability to generate random numbers"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Chromium browser credentials files"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Privilege Escalation","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"suspicious","value":"Able to retrieve open application windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"},{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Able to download remote files (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2\" in Source: sample.bin, \"Opera Software\\Opera Stable\\Login Data\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: sample.bin, \"SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"DoShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"DoShellExecuteResponse\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.009","id":"string-545","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Are you mixing protobuf-net and protobuf-csharp-port? See https://stackoverflow.com/q/11564914/23354; type: \" (Indicator: \"stackoverflow.com\"), \"; please see https://stackoverflow.com/q/14436606/23354\" (Indicator: \"stackoverflow.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Source: sample.bin, Indicator: \"select caption from win32_operatingsystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\runonce\"; in Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$27","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Name\npasswordField\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"password_value\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"{0}\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: sample.bin, \"{0}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1552.001","id":"string-11","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\"), Found reference to API \"MapVirtualKeyEx\" (Indicator: \"MapVirtualKey\"; Source: \"sample.bin\"), Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"sample.bin\"), Found reference to API \"UnregisterHotKey\" (Indicator: \"UnregisterHotKey\"; Source: \"sample.bin\"), Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"\\..\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\") in Source: sample.bin, \"Opera Software\\Opera Stable\\Login Data\" (Indicator: \"opera software\\opera stable\\login data\") in Source: sample.bin, \"Mozilla\\Firefox\\Profiles\" (Indicator: \"mozilla\\firefox\\\") in Source: sample.bin, \"Yandex\\YandexBrowser\\User Data\\Default\\Login Data\" (Indicator: \"yandex\\yandexbrowser\\user data\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-93","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access scheduled job timer","description":"Found string \"System.Timers\" (Indicator: \".timer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.006","id":"string-5057","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin, Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; Source: \"sample.bin\"), Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; Source: \"sample.bin\"), Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"sample.bin\"), Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"sample.bin\"), Found reference to API \"CryptAcquireContext\" (Indicator: \"CryptAcquireContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptHashData\" (Indicator: \"CryptHashData\"; Source: \"sample.bin\"), Found api reference \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; Source: \"sample.bin\"), Found api reference \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"sample.bin\"), Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found api reference \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; Source: \"sample.bin\"), Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; Source: \"sample.bin\"), Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"sample.bin\"), Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"[PRIVATE KEY LOCATION: \"{0}\"]\" (Indicator: \"private key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-352","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.Pk11sdrDecrypt\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-357","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.k__BackingField\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-358","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.AesCryptoServiceProvider.Pk11sdrDecrypt\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfoResponse\" in \"sample.bin\", Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"k__BackingField\" (Indicator: \"countrycode\") in Source: sample.bin, \"set_CountryCode\" (Indicator: \"countrycode\") in Source: sample.bin, \"get_CountryCode\" (Indicator: \"countrycode\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-575","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"15.8.0.0\", \"15.0.0.0\", \"2.4.6.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"Found string \"@echo off\nchcp 65001\necho DONT CLOSE THIS WINDOW!\nping -n 10 localhost > nul\ndel /a /q /f \"\" (Indicator: \"ping -\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-5070","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://stackoverflow.com\", Found HTTPS url \"https://tools.keycdn.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://stackoverflow.com/q/11564914/23354\", Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\", Pattern match: \"https://tools.keycdn.com/geo.json\", Heuristic match: \"\n*.sh\", Pattern match: \"https://stackoverflow.com/q/14436606/23354\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-273","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00004348.00000000.76028.01D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$29","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"LoadResource with parameter {'hModule': '1966735360', 'hResInfo': '1836528'}\" (UID: 00000000-00005412)\n \"Realtek HD Audio Universal Services.exe\" called \"LoadResource with parameter {'hModule': '1966735360', 'hResInfo': '6555120'}\" (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"Realtek HD Audio Universal Services.exe\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"Realtek HD Audio Universal Services.exe\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"Realtek HD Audio Universal Services.exe\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"Realtek HD Audio Universal Services.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004348.00000000.76028.01D40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004348.00000000.76028.01D40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005412.00000000.71739.00420000.00000004.mdmp, 00000000-00005412.00000000.71739.019F0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005412.00000000.71739.019F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"ToBase64String\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"FromBase64String\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"ToBase64String\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"]\n Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004348.00000000.76028.01D40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004348.00000000.76028.01D40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005412.00000000.71739.00420000.00000004.mdmp, 00000000-00005412.00000000.71739.019F0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005412.00000000.71739.019F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp, 00000000-00004348.00000001.77950.00280000.00000004.mdmp, 00000000-00004348.00000002.79872.00280000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005412.00000000.71739.00420000.00000004.mdmp, 00000000-00005412.00000001.73663.00420000.00000004.mdmp, 00000000-00005412.00000002.75586.00420000.00000004.mdmp, 00000000-00005412.00000003.75711.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"Realtek HD Audio Universal Services.exe\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"Realtek HD Audio Universal Services.exe\" at offset 256808; code bytes = 30d0\n Found XOR loop in file \"Realtek HD Audio Universal Services.exe\" at offset 490272; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 256808; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 490272; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005412-00000C2C-131301339\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed dotnet function \"GetDirectories\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed dotnet function \"GetFiles\" in \"Realtek HD Audio Universal Services.exe\"\n Observed dotnet function \"GetDirectories\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005412-00000C2C-131301339\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00004348-00000C2C-195917170\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004348-00000C2C-196140515\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005412-00000C2C-129662715\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005412-00000C2C-129663457\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005412-00000C2C-193306891\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005412-00000C2C-193306962\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005412)\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005412)\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005412)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005412)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"IsWow64Process\" with parameter \"5412\" - (UID: 00000000-00005412)\n \"Realtek HD Audio Universal Services.exe\" called \"IsWow64Process\" with parameter \"4348\" - (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"GetWindowTextW\" (UID: 00000000-00005412)\n \"Realtek HD Audio Universal Services.exe\" called \"GetWindowTextW\" (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005412)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005412)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005412)\n \"Realtek HD Audio Universal Services.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"get_SystemDirectory\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"get_MachineName\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"get_OSVersion\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"get_Is64BitOperatingSystem\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"get_UserName\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"get_SystemDirectory\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"get_MachineName\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"get_OSVersion\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Realtek HD Audio Universal Services.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"摁쁙暳꬛릯濟잺돃珈⁷虓ᖦ갶㳉试摲⪶::풃ꆙẼ䒄ⷾ⋅쮎㋫滁昜༰庳ᫀ㨅➿鉰�竫(똇경쯴㉋౏纍尋緧氅ΐ蟀튗훯Ἷ趑郻,Quasar.Common.Messages.GetSystemInfo) at a760c4263a2d1e144c2fd116bf1351e1-60001c2-_~Execute\n Quasar.Common.Messages.GetSystemInfoResponse::set_SystemInfos(System.Collections.Generic.List`1>) at a760c4263a2d1e144c2fd116bf1351e1-60001c3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at a760c4263a2d1e144c2fd116bf1351e1-6000953-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \",,RtlGetVersion,NTDLL.dll,\"252:05:17.251\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp, 00000000-00004348.00000001.77950.00280000.00000004.mdmp, 00000000-00004348.00000002.79872.00280000.00000004.mdmp\")\n Found reference to API \"69636808,5396,3024,,RtlGetVersion,NTDLL.dll,\"252:05:12.213\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00005412.00000002.75586.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" queries volume information of \"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" at 00000000-00005412-0000010C-2861707\n \"Realtek HD Audio Universal Services.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe\" at 00000000-00004348-0000010C-2199199\n \"Realtek HD Audio Universal Services.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll\" at 00000000-00004348-0000010C-65648609\n \"Realtek HD Audio Universal Services.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll\" at 00000000-00004348-0000010C-65654818","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Realtek HD Audio Universal Services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Realtek HD Audio Universal Services.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")\n Found string \"M Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"$2f","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed API \"GetProcAddress\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed API \"MapVirtualKeyEx\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed API \"LoadLibrary\" in \"Realtek HD Audio Universal Services.exe\"\n Observed API \"GetProcAddress\" in \"Realtek HD Audio Universal Services.exe\"\n Observed API \"MapVirtualKeyEx\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"CopyFileW\" to copy C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe to new location %APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe (UID: 00000000-00005412)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005412)\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005412)\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Realtek HD Audio Universal Services (UID: 00000000-00005412)\n \"Realtek HD Audio Universal Services.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004348)\n \"Realtek HD Audio Universal Services.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"CreateProcessW\" with parameter \"\"schtasks\" /create /tn \"Realtek\" /sc ONLOGON /tr \"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" /rl HIG\" - (UID: 00000000-00005412)\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe\"\" - (UID: 00000000-00005412)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"222.253.182.185:9090\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"Realtek HD Audio Universal Services.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"Realtek HD Audio Universal Services.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"Realtek HD Audio Universal Services.exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"Realtek HD Audio Universal Services.exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"Process.set_StartInfo\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"Process.Start\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"Process.set_StartInfo\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\b629c3f9-6e84-4b12-aa44-142bd48d26fe\"\n Process Realtek HD Audio Universal Services.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process Realtek HD Audio Universal Services.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\b629c3f9-6e84-4b12-aa44-142bd48d26fe\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"$32","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Realtek HD Audio Universal Services.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$34","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A\" (Indicator: \"mozilla/5.0 (\"; File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\" (Indicator: \"mozilla/5.0 (\"; File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75C10000\n \"Realtek HD Audio Universal Services.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75C10000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 62CD0000\n \"Realtek HD Audio Universal Services.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 62520000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74B50000\n \"Realtek HD Audio Universal Services.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74B50000\n \"Realtek HD Audio Universal Services.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74710000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63930000\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 640E0000\n \"Realtek HD Audio Universal Services.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 640E0000\n \"Realtek HD Audio Universal Services.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63930000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 760E0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 760E0000\n \"Realtek HD Audio Universal Services.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 760E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f46e75@RPCRT4.dll\"\n \"1800190068e8a76a@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8a76a@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5fa76a@ntdll.dll\"\n \"100011000e03806b@ADVAPI32.dll\"\n \"0d000e002203806b@ADVAPI32.dll\"\n \"0d000e00fe02806b@ADVAPI32.dll\"\n \"0b000c00cc02806b@ADVAPI32.dll\"\n \"10001100da02806b@ADVAPI32.dll\"\n \"150016002073416b@ADVAPI32.dll\"\n \"0e000f00e473416b@ADVAPI32.dll\"\n \"0e000f005074416b@ADVAPI32.dll\"\n \"11001200d47d416b@ADVAPI32.dll\"\n \"110012007c7e416b@ADVAPI32.dll\"\n \"12001300cc7e416b@ADVAPI32.dll\"\n \"12001300387f416b@ADVAPI32.dll\"\n \"14001500e4b7416b@ADVAPI32.dll\"\n \"1400150000b8416b@ADVAPI32.dll\"\n \"140015001cb8416b@ADVAPI32.dll\"\n \"1700180038b8416b@ADVAPI32.dll\"\n \"0d000e0054b8416b@ADVAPI32.dll\"\n \"1100120064b8416b@ADVAPI32.dll\"\n \"110012007cb8416b@ADVAPI32.dll\"\n \"0f001000ecb9416b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\" was detected as \".NET\" and name: \"Library\"\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Realtek HD Audio Universal Services.exe\" was detected as \".NET\" and name: \"Library\"\n \"Realtek HD Audio Universal Services.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Realtek HD Audio Universal Services.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\" has an executable section named \".text\"\n \"Realtek HD Audio Universal Services.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$37","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"schtasks.exe\" (UID: 00000000-00003848) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"schtasks.exe\" (UID: 00000000-00003848) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Realtek HD Audio Universal Services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Realtek HD Audio Universal Services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Realtek HD Audio Universal Services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00004348.00000002.79872.00280000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005412.00000002.75586.00420000.00000004.mdmp, 00000000-00005412.00000003.75711.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Realtek\" /sc ONLOGON /tr \"C:\\\\37fa30c9dc ...\" (UID: 00000000-00003848), Spawned process \"Realtek HD Audio Universal Services.exe\" (UID: 00000000-00004348)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Realtek\" /sc ONLOGON /tr \"C:\\\\37fa30c9dc ...\" (UID: 00000000-00003848), Spawned process \"Realtek HD Audio Universal Services.exe\" (UID: 00000000-00004348)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Realtek HD Audio Universal Services.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"Realtek HD Audio Universal Services.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Realtek HD Audio Universal Services.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe]- [targetUID: 00000000-00004348]\n \"Tar37C3.tmp\" has type \"DER Encoded PKCS#7 Signed Data\"- [targetUID: N/A]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A \"authroot.stl\" number 1 7 datablocks 0x1 compression\"- [targetUID: N/A]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"data\"- [targetUID: N/A]\n \"Cab37C2.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A \"authroot.stl\" number 1 7 datablocks 0x1 compression\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Tar37C3.tmp\" has type \"DER Encoded PKCS#7 Signed Data\"\n \"Cab37C2.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A \"authroot.stl\" number 1 7 datablocks 0x1 compression\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 5412)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify sandbox environment running process","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\realtek hd audio universal services\\realtek hd audio universal services.exe\"\n \"Realtek HD Audio Universal Services.exe\" writes file \"%appdata%\\realtek hd audio universal services\\realtek hd audio universal services.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed dotnet function \"WebRequest.GetResponse\" in \"Realtek HD Audio Universal Services.exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping -n 10 localhost > nul\" (Indicator: \"ping \"; Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"ping -n 10 localhost > nul\" (Indicator: \"ping \"; Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005412)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$40","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"$41","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Net.Sockets\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Net.Security\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed namespace \"System.Net.NetworkInformation\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004348.00000000.76028.01140000.00000002.mdmp, 00000000-00004348.00000001.77950.01140000.00000002.mdmp, 00000000-00004348.00000002.79872.01140000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005412.00000000.71739.00DF0000.00000002.mdmp, 00000000-00005412.00000001.73663.00DF0000.00000002.mdmp, 00000000-00005412.00000002.75586.00DF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: eb88d0b3e1961a0562f006e5ce2a0b87","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00004348.00000002.79872.00280000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE40DB1BAAFB4C46E192D3FB7B1532]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005412.00000003.75711.00420000.00000004.mdmp\")\n Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00005412.00000003.75711.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"$43","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005412.00000003.75711.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \",,RtlGetVersion,NTDLL.dll,\"252:05:17.251\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp, 00000000-00004348.00000001.77950.00280000.00000004.mdmp, 00000000-00004348.00000002.79872.00280000.00000004.mdmp\")\n Found reference to API \"69636808,5396,3024,,RtlGetVersion,NTDLL.dll,\"252:05:12.213\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005412.00000002.75586.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004348.00000000.76028.01D40000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004348.00000000.76028.01D40000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005412.00000000.71739.00420000.00000004.mdmp, 00000000-00005412.00000000.71739.019F0000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005412.00000000.71739.019F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Realtek HD Audio Universal Services.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"get_ProcessName\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"GetProcessById\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed function \"GetProcessesByName\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"get_ProcessName\" in \"Realtek HD Audio Universal Services.exe\"\n Observed function \"GetProcessById\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at a760c4263a2d1e144c2fd116bf1351e1-600003d-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"

[Esc]

\" (Indicator: \"[esc]\"; File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")\n Found string \"[f7]\" (Indicator: \"[F7]\"; Source: \"00000000-00004348.00000001.77950.00280000.00000004.mdmp, 00000000-00004348.00000002.79872.00280000.00000004.mdmp\")\n Found string \"p class=\"h\">[Esc]

\" (Indicator: \"[esc]\"; Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"p class=\"h\">[Esc]

\" (Indicator: \"[esc]\"; Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"Found string \"\\..\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")\n Found string \"Opera Software\\Opera Stable\\Login Data\" (Indicator: \"opera software\\opera stable\\login data\"; File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")\n Found string \"Yandex\\YandexBrowser\\User Data\\Default\\Login Data\" (Indicator: \"yandex\\yandexbrowser\\user data\\default\\login data\"; File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")\n Found string \"..\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; Source: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n Found string \"..\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; Source: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"logins.json\" (Indicator: \"logins.json\"; in File: \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00005412), \"Realtek HD Audio Universal Services.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\" (UID: 00000000-00004348)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp, 00000000-00004348.00000001.77950.00280000.00000004.mdmp, 00000000-00004348.00000002.79872.00280000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005412.00000000.71739.00420000.00000004.mdmp, 00000000-00005412.00000001.73663.00420000.00000004.mdmp, 00000000-00005412.00000002.75586.00420000.00000004.mdmp, 00000000-00005412.00000003.75711.00420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: 37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp, 00000000-00004348.00000000.76028.01D40000.00000004.mdmp, 00000000-00004348.00000001.77950.00280000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege \" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005412.00000000.71739.00420000.00000004.mdmp, 00000000-00005412.00000001.73663.00420000.00000004.mdmp, 00000000-00005412.00000002.75586.00420000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005412.00000000.71739.019F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"Realtek HD Audio Universal Services.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DEBUGHEAPFLAGS\"; Value: \"\")\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"LDAPCLIENTINTEGRITY\"; Value: \"\")\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEOLDHOSTRESOLUTIONORDER\"; Value: \"\")\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEHOSTNAMEASALIAS\"; Value: \"\")\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"IPV4LOOPBACKALTERNATIVE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"services.exe,svchost.exe,csrss.exe,winlogon.exe,spoolsv.exe\" (Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Realtek HD Audio Universal Services.exe\" - Location: [%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe]- [targetUID: 00000000-00004348]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"Realtek HD Audio Universal Services.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Realtek HD Audio Universal Services.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to retrieve open application windows","description":"Observed API \"GetForegroundWindow\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed API \"GetWindowText\" in \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf\"\n Observed API \"GetForegroundWindow\" in \"Realtek HD Audio Universal Services.exe\"\n Observed API \"GetWindowText\" in \"Realtek HD Audio Universal Services.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-222","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/24 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Realtek HD Audio Universal Services.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe]- [targetUID: 00000000-00004348]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"6000207-_~_\")\n \"ttps://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"00000000-00004348.00000002.79872.010B2000.00000020.mdmp\")\n \"ttps://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005412.00000002.75586.00D62000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe\" connects to 199.232.210.172 on port 80 (TCP)\n Process \"%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe\" connects to 222.253.182.185 on port 9090 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_GENInfoStealer\" matched file \"sample.bin\" as \"Detects executables containing common artifacts observed in infostealers\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA\" matched file \"sample.bin\" as \"Detects Windows executables referencing non-Windows User-Agents\"\n YARA signature \"INDICATOR_SUSPICIOUS_GENInfoStealer\" matched file \"Realtek HD Audio Universal Services.exe.883824802\" as \"Detects executables containing common artifacts observed in infostealers\"\n YARA signature \"INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA\" matched file \"Realtek HD Audio Universal Services.exe.883824802\" as \"Detects Windows executables referencing non-Windows User-Agents\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00004348.00000000.76028.00280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe:Zone.Identifier\" with delete access\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe:Zone.Identifier\" with delete access\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe:ZONE.IDENTIFIER\" with delete access\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe:ZONE.IDENTIFIER\" with delete access\n \"Realtek HD Audio Universal Services.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"Realtek HD Audio Universal Services.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A \"authroot.stl\" number 1 7 datablocks 0x1 compression\"- [targetUID: N/A]\n \"Cab37C2.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A \"authroot.stl\" number 1 7 datablocks 0x1 compression\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe:Zone.Identifier\" with delete access\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe:Zone.Identifier\" with delete access\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe:ZONE.IDENTIFIER\" with delete access\n \"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe:ZONE.IDENTIFIER\" with delete access\n \"Realtek HD Audio Universal Services.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Observed Malicious SSL Cert (Quasar CnC)\" (SID: 2027619, Rev: 4, Severity: 1) categorized as \"Domain Observed Used for C2 Detected\" (PUA/PUP/Adware)\n Detected alert \"ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert\" (SID: 2035595, Rev: 6, Severity: 1) categorized as \"Domain Observed Used for C2 Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/24 Antivirus vendors marked sample as malicious (79% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"19/24 Antivirus vendors marked dropped file \"Realtek HD Audio Universal Services.exe\" as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 79% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"19/24 Antivirus vendors marked spawned process \"Realtek HD Audio Universal Services.exe\" (PID: 4348) as malicious (classified as \"Generic.MSIL.PasswordStealerA\" with 79% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Realtek\" /sc ONLOGON /tr \"C:\\\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" /rl HIGHEST /f\" (UID: 00000000-00003848)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 222.253.182.185 on port 9090","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"sample.bin\" as \"Detects Quasar infostealer\"\n YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"Realtek HD Audio Universal Services.exe.883824802\" as \"Detects Quasar infostealer\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – zgRAT","origin":"Indicator Combinations","relevance":10,"id":"summary-5016","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}],"intel_graph":{"map":{"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300":{"type":"Adversary","value":"BLIND SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"File:095994e019d3764379afd2df7b961a36c9a41bd965325ea468754ac3e16cbf27":{"type":"File","value":"095994e019d3764379afd2df7b961a36c9a41bd965325ea468754ac3e16cbf27"},"File:1fc6ab8880452fa36097383e6203fe179002cb099b147191b7926a6d3465b8c2":{"type":"File","value":"1fc6ab8880452fa36097383e6203fe179002cb099b147191b7926a6d3465b8c2"},"File:24e452010983500f80d22a687c89f823f54096196659fe0ad4aaebcad0bf3fb3":{"type":"File","value":"24e452010983500f80d22a687c89f823f54096196659fe0ad4aaebcad0bf3fb3","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf":{"type":"File","value":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates scheduled task using schtasks.exe","Detected malware C2 configuration","Detected relationship with a Threat Quasar","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4d0d086f999227d9faef7aa38e5fbfc5e0e31441d632e89530ea051695defdf8":{"type":"File","value":"4d0d086f999227d9faef7aa38e5fbfc5e0e31441d632e89530ea051695defdf8","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71":{"type":"File","value":"f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71"},"Ip:222.253.182.185":{"type":"Ip","value":"222.253.182.185"},"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c":{"type":"Threat","value":"Quasar","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]}},"Url:b679d4235b12072fa5f1ab929efc1a4a189e847881564bf605bdae73155bb678":{"type":"Url","value":"tcp://222.253.182.185:9090","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1543627718831222248","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates scheduled task using schtasks.exe","Detected malware C2 configuration","Detected relationship with a Threat Quasar","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]}},{"id":"1543627736469479535","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"is_threat","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with an Adversary BLIND SPIDER"]}},{"id":"1543627713498281487","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"contains_c2_config","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"Url:b679d4235b12072fa5f1ab929efc1a4a189e847881564bf605bdae73155bb678"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543627713498281485","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"memory","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:24e452010983500f80d22a687c89f823f54096196659fe0ad4aaebcad0bf3fb3"},{"edge_kind":"is_threat","from_key":"File:24e452010983500f80d22a687c89f823f54096196659fe0ad4aaebcad0bf3fb3","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543627713498281488","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"memory","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:24e452010983500f80d22a687c89f823f54096196659fe0ad4aaebcad0bf3fb3"},{"edge_kind":"contains_c2_config","from_key":"File:24e452010983500f80d22a687c89f823f54096196659fe0ad4aaebcad0bf3fb3","to_key":"Url:b679d4235b12072fa5f1ab929efc1a4a189e847881564bf605bdae73155bb678"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543627713498281486","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"memory","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:4d0d086f999227d9faef7aa38e5fbfc5e0e31441d632e89530ea051695defdf8"},{"edge_kind":"is_threat","from_key":"File:4d0d086f999227d9faef7aa38e5fbfc5e0e31441d632e89530ea051695defdf8","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543627713498281489","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"memory","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:4d0d086f999227d9faef7aa38e5fbfc5e0e31441d632e89530ea051695defdf8"},{"edge_kind":"contains_c2_config","from_key":"File:4d0d086f999227d9faef7aa38e5fbfc5e0e31441d632e89530ea051695defdf8","to_key":"Url:b679d4235b12072fa5f1ab929efc1a4a189e847881564bf605bdae73155bb678"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543627721057530717","root":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c","edges":[{"edge_kind":"used_by","from_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c","to_key":"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1543627721061725022","root":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"contacted_ip","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"Ip:222.253.182.185"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","edges":[{"edge_kind":"extracted","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf"},{"edge_kind":"extracted","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71"},{"edge_kind":"extracted","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:1fc6ab8880452fa36097383e6203fe179002cb099b147191b7926a6d3465b8c2"},{"edge_kind":"extracted","from_key":"File:37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","to_key":"File:095994e019d3764379afd2df7b961a36c9a41bd965325ea468754ac3e16cbf27"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":115,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":1,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","rat","quasar","opensource","targeted","criminal","infostealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a89e42790da66f52f0b8ae8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.PasswordStealerA","contacted_countries":["VNM"],"submit_name":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","analysis_start_time":"2026-08-22T18:02:17+00:00","indicators_count":{"informative":191,"suspicious":32,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"222.253.182.185","port":9090,"protocol":"TCP","country":"Vietnam","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}],"dns_resolutions":null,"http_requests":null,"embedded_urls":[{"value":"tcp://222.253.182.185:9090","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}],"processes":[{"pid":5412,"ppid":0,"name":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe","command_line":"","sha256":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","normalized_path":"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe","uid":"00000000-00005412","icon":"$48"},{"pid":3848,"ppid":5412,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"Realtek\" /sc ONLOGON /tr \"C:\\37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf.exe\" /rl HIGHEST /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005412","uid":"00000000-00003848"},{"pid":4348,"ppid":5412,"name":"Realtek HD Audio Universal Services.exe","command_line":"","sha256":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","normalized_path":"%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe","parent_uid":"00000000-00005412","uid":"00000000-00004348"}],"all_imported_dlls":["api-ms-win-core-xstate-l2-1-0.dll","RpcRtRemote.dll","ws2_32.dll","System.Windows.Forms.dll","Wldap32.dll","secur32.dll","lpk.dll","certcli.dll","advapi32.dll","taskschd.dll","wship6.dll","userenv.dll","uxtheme.dll","api-ms-win-crt-time-l1-1-0.dll","version.dll","profapi.dll","clbcatq.dll","cabinet.dll","KernelBase.dll","fltLib.dll","bcryptprimitives.dll","msvcp140.dll","vcruntime140.dll","rpcss.dll","System.Configuration.ni.dll","cryptnet.dll","winnsi.dll","dnsapi.dll","atl.dll","webio.dll","gdi32.dll","ucrtbase.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","System.Xml.ni.dll","psapi.dll","SensApi.dll","rasadhlp.dll","api-ms-win-crt-string-l1-1-0.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","xmllite.dll","VxSSL32.dll","sechost.dll","cryptsp.dll","rsaenh.dll","api-ms-win-crt-environment-l1-1-0.dll","wtsapi32.dll","api-ms-win-crt-math-l1-1-0.dll","Accessibility.ni.dll","winhttp.dll","devobj.dll","nsi.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-file-l1-2-0.dll","ktmw32.dll","System.Runtime.Serialization.ni.dll","apphelp.dll","FWPUCLNT.DLL","shell32.dll","System.Security.ni.dll","gpapi.dll","api-ms-win-core-synch-l1-2-0.dll","WSHTCPIP.DLL","IPHLPAPI.DLL","mscoreei.dll","dwmapi.dll","dhcpcsvc6.dll","System.Windows.Forms.ni.dll","api-ms-win-core-processthreads-l1-1-1.dll","bcrypt.dll","api-ms-win-crt-utility-l1-1-0.dll","msctf.dll","System.ni.dll","comctl32.dll","ole32.dll","dsrole.dll","dhcpcsvc.dll","mscoree.dll","rpcrt4.dll","msasn1.dll","sspicli.dll","mscorrc.dll","System.Data.SqlXml.ni.dll","setupapi.dll","shlwapi.dll","cryptbase.dll","clrjit.dll","crypt32.dll","schannel.dll","cfgmgr32.dll","msvcrt.dll","api-ms-win-core-file-l2-1-0.dll","System.ServiceModel.dll","mswsock.dll","ncrypt.dll","kernel32.dll","usp10.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","credssp.dll","user32.dll","api-ms-win-crt-stdio-l1-1-0.dll","oleaut32.dll","clr.dll","devrtl.dll","ntdll.dll","api-ms-win-crt-convert-l1-1-0.dll","System.Drawing.ni.dll","api-ms-win-crt-runtime-l1-1-0.dll","imm32.dll","mscorlib.ni.dll","nlssorting.dll","vcruntime140_clr0400.dll","winsta.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Realtek HD Audio Universal Services.exe","sha256":"37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"Cab37C2.tmp","sha256":"f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"Tar37C3.tmp","sha256":"1fc6ab8880452fa36097383e6203fe179002cb099b147191b7926a6d3465b8c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"095994e019d3764379afd2df7b961a36c9a41bd965325ea468754ac3e16cbf27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"path":"%APPDATA%\\Realtek HD Audio Universal Services\\Realtek HD Audio Universal Services.exe","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\AUTOENROLLMENT\\","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\b629c3f9-6e84-4b12-aa44-142bd48d26fe","sources":[{"report_type":"sandbox","report_id":"6a89e42790da66f52f0b8ae8"}]}]}},"report_ids":{"sandbox_job_ids":["6a89e42790da66f52f0b8ae8"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSIL.PasswordStealerA.Generic Sample 37fa30c9dcf2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 37fa30c9dcf2…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL.PasswordStealerA.Generic Sample 37fa30c9dcf2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 37fa30c9dcf2…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL.PasswordStealerA.Generic Sample 37fa30c9dcf2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 37fa30c9dcf2…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 21/25 AV engines flagged this file. 11 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L49","11",{}]]