24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILKrypt.Generic Sample 3d0efd55bde5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3d0efd55bde5…. Malware family: MSILKrypt.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","keywords":["Malicious","MSILKrypt.Generic","malware analysis","sandbox report","threat intelligence","3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe"],"about":{"@type":"SoftwareApplication","name":"Trololololo.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILKrypt.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta9b,Found malicious artifacts related to "128.177.96.51" (ASN: 6461, Owner: Abovenet Communications, Inc): ... URL: http://myphone-download.wondershare.cc/ (AV positives: 4/63 scanned on 07/16/2015 08:49:07) URL: http://www.nba.com/.element/iframe/2.0/video/third_party_player/iframe.html (AV positives: 1/63 scanned on 07/09/2015 12:18:04) URL: http://h30438.www3.hp.com/pub/softlib/software11/COL29215/al-72489-3/DJ_AIO_06_F2400_NonNet_Basic_Win_kor_140_175.exe (AV positives: 2/63 scanned on 07/04/2015 00:51:50) URL: http://www.unicef.org/ (AV positives: 1/63 scanned on 07/03/2015 11:39:56) URL: http://download.wondershare.com/wss_full99_sm166320.exe (AV positives: 1/63 scanned on 06/23/2015 02:04:04) File SHA256: f045a9155ed495fbe332207608641625e4fdaf05beb8a25972d3640c06ce1a14 (AV positives: 1/55 scanned on 06/23/2015 02:04:14) File SHA256: 1d3cf998af3291a7ee0aa14b9ec8ae34a1d1120dbc0b901a8a4b41269999efc5 (AV positives: 6/56 scanned on 04/17/2015 11:58:14) File SHA256: 22bf97441bfdf6e985ef9dd0b4ea0a7c408073e29284886770ebb5ecb42b30a3 (AV positives: 1/57 scanned on 04/16/2015 22:51:25) File SHA256: eea2796733eed6dd0af0a460c97050157f0f70bde9c51de3f16eae7d7d90d0d1 (AV positives: 1/57 scanned on 04/16/2015 20:57:15) File SHA256: a3ec5cd8fb2982a6e645f550ea369dab5ea6133508330eea85db6231d5b6eabd (AV positives: 1/56 scanned on 04/16/2015 20:56:56) Found malicious artifacts related to "128.177.96.43" (ASN: 6461, Owner: Abovenet Communications, Inc): ... URL: http://content.rim.com.edgesuite.net/ (AV positives: 1/63 scanned on 07/04/2015 00:22:22) URL: http://download.cdn.jzip.com/cdn/r/0/jZipSetup-r0-n.exe (AV positives: 9/63 scanned on 04/29/2015 08:47:50) URL: http://asrv-a.akamaihd.net/ (AV positives: 3/63 scanned on 04/29/2015 07:11:10) URL: http://www.trendmicro.com.ru/media/customer-story/deep-security-yapi-kredi-bank-en.pdf (AV positives: 1/63 scanned on 04/28/2015 08:46:33) URL: http://z.cdn.turner.com/money/tmpl_asset/static/script/463/js/cnnmoney.legal.docs-min.js/ (AV positives: 1/62 scanned on 04/27/2015 08:25:09) File SHA256: b642d32ef377cf65803ae6fa5088127502195b62d6ca36d635f354c9fe1f22ca (AV positives: 1/55 scanned on 04/18/2015 13:21:39) File SHA256: 2adceaf7d5a9737b34874603b500f5c64493568b7af8157f3a57b0de34e94644 (AV positives: 1/57 scanned on 04/15/2015 20:51:17) File SHA256: 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f (AV positives: 54/57 scanned on 03/25/2015 11:40:37) File SHA256: adb3bb6dc08f43c351e0c99024d1eab5ed4f831ed81fd5a2d1aec27edcc4fc67 (AV positives: 2/56 scanned on 03/21/2015 11:18:47) File SHA256: bf85162443e69e295031b34825000f873bc5385ff38cc8351976dea86aa35452 (AV positives: 1/56 scanned on 03/09/2015 17:00:12)26:T49e,"" loaded module "CLBCATQ.DLL" at base 759C0000 "" loaded module "SXS.DLL" at base 74F90000 "" loaded module "ADVAPI32.DLL" at base 76C60000 "" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77040000 "" loaded module "CRYPTSP.DLL" at base 74AB0000 "" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74850000 "" loaded module "CRYPTBASE.DLL" at base 74F80000 "" loaded module "RPCRTREMOTE.DLL" at base 75020000 "" loaded module "OLEAUT32.DLL" at base 75380000 "" loaded module "OLE32.DLL" at base 769D0000 "" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 769D0000 "" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 60340000 "" loaded module "WINMM.DLL" at base 715A0000 "" loaded module "%WINDIR%\SYSTEM32\WINMM.DLL" at base 715A0000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77040000 "" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 7704000027:T4aa,".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config" ".exe" touched file "C:\Windows\assembly\pubpol107.dat" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_64\index2b5.dat" ".exe" touched file "C:\Windows\Fonts\msyh.ttf" ".exe" touched file "C:\Windows\Fonts\malgun.ttf" ".exe" touched file "C:\Windows\Fonts\micross.ttf"28:T2d22,"Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000b3d01a7bc06900000800000000000000ffffffffffffffff3400000000000000f6056c72fc7f0000c8e9cf0000000000db04b186fc7f000000000000fc7f00002a96dc83fc7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000030eacf000000000008000000000000000000000000000000000000000000000023221a7bc0690000c3f0af86fc7f00000000cc85fc7f0000a713b086fc7f000088eacf00 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000002000000000000004000000000000000000000000000000000000000000000004000000000000000eb48b364fc7f0000180000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000ffffffffffffffff2400000000000000f8f7cf0000000000040000000000000000000000000000000000000000000000000000000000000085bcb564fc7f00000200000000000000010000000000000001000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ace684fc7f0000000000000000000051edb386fc7f0000000000000000000000000000000000008a32b747693000002a00000000000000e0d1de02000000008fecb386fc7f0000e0ace684fc7f0000e0ace684fc7f0000000000000000000000000000fc7f0000ffffff7f5475000000000000000000000000000000000000d8ceda84fc7f00002a0000000000000069c39384fc7f0000310000000000000010020000000000001402000000000000110001100000000010e4cf000000000003a3ea85fc7f000010e4cf000000000000000000000000002b00000000000000000000000000000020b09984fc7f0000b43f9884fc7f0000e0ceda84 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000010f5cf0000000000feffffffffffffffc065e002000000000100000000000000000000000000000014000000000200000400000073006f0098f2cf000000000032002e0030002e003500300037003200370000007900200043006f006e006600690067005c000000d0f3cf000000000061e86b72fc7f00000000000100000000020000000000000000000000000000000a020000000000000a02000000000000a88d0765fc7f000000000000000000000000000000000000020000000000000000000000000000009e00009e00000000feffffffffffffff0100000060000000a9000000000000009e0000000000000078119e64fc7f000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000eb48b364fc7f00000000dc0200000000340000c00000000000000000000000000000dc020000000000000000000000003016b386fc7f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006bc3b464fc7f000010f5cf0000000000020000000000000000000000000000000a020000000000000200000002000000feffffffffffffff2100000000000000aa3db664fc7f000010f5cf0000000000305de0020000000004010000000000000a020000000000000000000000000000fe08ac64fc7f0000050000000000000001000000fc7f000004010000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c2965fc7f0000000000000000000035e7c564fc7f000090fc2865fc7f00000000000000000000000000000000000000000000000000000000000000000000001e1065fc7f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff00800000000000000000b09de00200000000c047e10200000000feffffffffffffffee9fb864fc7f00000100000000000000b05fe102000000000000000000000000b09de00200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc2865fc7f000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000c0000000200000000000000000000000000000000000000feffffffffffffff01000000000000000012e20200000000010000800000000000000000000000002b40a964fc7f000001000000000000000100008000000000f0eacf000000000030317d83fc7f0000e0e9cf00000000002b40a964fc7f0000e0e9cf00000000009c3fa964fc7f0000010000800000000000000000000000008000a21d000000000000000000000000e0e9cf0000000000a241a964fc7f0000c0020000000000000000000000000000010000000000000028e1ef64fc7f0000000000000000000000000000000000000000000000000000a001e1020000000012000080 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000004071e3020000000000000000000000000000000000000000feffffffffffffff10000000040001000000000000000000daa4413036340000c046e10200000000a0e4cf0000000000880000000000000000000000000000004071e302000000008800000000000000eb48b364fc7f00000000000000000000d50bb564fc7f0000a0e4cf0000000000d073e102000000006015e20200000000d073e1020000000000000000000000004e438d64fc7f00000000000000000000000000000000000000000000000000000000000000000000d07be102000000002c448d64fc7f000088000000000000004071e3020000000010001000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c2965fc7f0000000000000000000035e7c564fc7f000090fc2865fc7f00000000000000000000000000000000000000000000000000000000000000000000001e1065fc7f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff008000000000000000006022e2020000000070cae40200000000feffffffffffffffee9fb864fc7f0000010000000000000070d1e4020000000000000000000000006022e20200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc2865fc7f000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c2965fc7f0000000000000000000035e7c564fc7f000090fc2865fc7f00000000000000000000000000000000000000000000000000000000000000000000001e1065fc7f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff00800000000000000000101de2020000000010b9e40200000000feffffffffffffffee9fb864fc7f0000010000000000000010c0e402000000000000000000000000101de20200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc2865fc7f000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000082c2965fc7f0000000000000000000035e7c564fc7f000090fc2865fc7f00000000000000000000000000000000000000000000000000000000000000000000001e1065fc7f00000000000000000000000000000000000000000000000000000000000000000000feffffffffffffffffffffffffffffff00000000ffff008000000000000000001022e20200000000c0c1e40200000000feffffffffffffffee9fb864fc7f00000100000000000000c0c9e4020000000000000000000000001022e20200000000feffffffffffffff000000000000000000000000000000000000000000000000000000000000000090fc2865fc7f000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000006034e0020000000001000000fc7f000016001700c0690000f1d3cf000000000000006f84fc7f00002a9e6b72fc7f00000000000000000000e06c7184fc7f000020d4cf0000000000f1d3cf0000000000300adf020000000000000000fc7f00000000000000000000feffffffffffffff000000000000000000006f84fc7f0000f1d3cf000000000004010000fc7f000041006d00730069005300630061006e004200750066006600650072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000005715000000000000100010000000000090d4cf00000000000000000000000000000000000000000000000000000000000016e50200000000996ab186fc7f00000000dc0200000000060000000000000000000000000000000000dc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001016e50200000000330000000000000000000000000000001016e5020000000071731065fc7f000006000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000002000002000000000000000000000000d3dc900000000000fbffffff00000000a0e4cf00fdffffff000000000000000030fcde020000000000000000000000001801d159fc7f0000382e2405fc7f0000184d2405fc7f0000382e2405fc7f0000300adf02000000020000000000000000b0e0cf0000000000feffffffffffffff000000000000000000000000000000006034e0020000000001000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000006000090300000000f079e3020000000030fcde0200000000000000000000000033da9b06 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000005715000000000000100010000000000074dd900000000000fbffffff0000000000000000fdffffff00000000000000000016e50200000000996ab186fc7f00000000dc0200000000382e2405fc7f000050e0cf0000000000382e2405fc7f00000000000000000000000000000000000080e0cf000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000001016e5020000000058787e5bfc7f000000000000000000001016e5020000000071731065fc7f000006000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000ffff2c000000fc7f000020d6cf00000000002a000264fc7f000018d7cf0000000000c85e625bfc7f00000000000000000000facdb364fc7f00002a00025bfc7f000078ce7d5bfc7f000028d8cf00000000008446bf64fc7f000000000000000000000000000000000000a849e102000000007d000000000000007d00002a00000000000000000000000098d8cf0000000000c85e625bfc7f00007d00002a000000003846bc64fc7f000078ce7d5bfc7f0000a049e10200000000184d2405fc7f00000000000000000000000000000000000000000000000000000000000000000000fe24b364fc7f00000600000002000000fefffffffffffffff2030006 (UID: 00000000-00000760)29:Ta8c,"Endermanch@Trololo.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000770069006e007300780073005c0061006d006400360034005f006d006900630072006f0073006f00660074002e0076006300380030002e006300720074005f0031006600630038006200330062003900610031006500310038006500330062005f0038002e0030002e00350030003700320037002e003900330034003800 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000093d41a7bc06900000400000000000000ffffffffffffffff2400000000000000f6056c72fc7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffff (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000063007400650064004400610074006100000073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760032002e0030002e00350030003700320037005c0063006f006e006600690067005c006d0061006300680069006e0065002e006300050000052d1a00005064dd02 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000038088464fc7f00000200000000000000000000000000000000008264fc7f000038088464fc7f0000000000000000000000000000000000008b209064fc7f000000000000000000000000000000000000000000000000000094d6cf000000000000000000 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000007f0000303d5764fc7f0000c0fe5864fc7f00000400000000000000c0fe5864fc7f000000000000000000000500000000000000453d5764fc7f0000286a5964fc7f0000be5a8383fc7f000098b9c71d00000000b0055964fc7f0000b08e8383fc7f0000239feb85fc7f00000100000000000000d1325764fc7f000000007c83 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000007f0000be5a8383fc7f000000005b64fc7f000000000000000000000000000000000000883f5c64fc7f00000001000000000000f098e985fc7f0000000100000000000000010000000000000000000000000000803f5c64fc7f00000100000000000000bf105b64fc7f00000000000000000000803f5c64fc7f000000000000 (UID: 00000000-00000760)2a:T521,"Endermanch@Trololo.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00000760-00000C15-48234009 "Endermanch@Trololo.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00000760-00000C15-48234218 "Endermanch@Trololo.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00000760-00000C15-49205731 "Endermanch@Trololo.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" at 00000000-00000760-00000C15-49205938 "Endermanch@Trololo.exe" queries volume information of "C:\Windows\Fonts\verdana.ttf" at 00000000-00000760-00000C15-49885880 "Endermanch@Trololo.exe" queries volume information of "C:\Windows\Fonts\verdanai.ttf" at 00000000-00000760-00000C15-49896652 "Endermanch@Trololo.exe" queries volume information of "C:\Windows\Fonts\verdanab.ttf" at 00000000-00000760-00000C15-49904836 "Endermanch@Trololo.exe" queries volume information of "C:\Windows\Fonts\verdanaz.ttf" at 00000000-00000760-00000C15-499124532b:T1b37,"Endermanch@Trololo.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\9833e30950e59154b7792b48938e4e97\mscorlib.ni.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\VERSION.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System\893341977b084a7627561c147da39e0c\System.ni.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Drawing\2c094d1b56df6b8c876057d130170612\System.Drawing.ni.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\58e2621ea621f062372147f12c6c27f1\System.Windows.Forms.ni.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\Gdiplus.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winmm.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000760) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004860) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004860) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004860) "taskkill.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004860) "taskkill.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00004860) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006376) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006376) "taskkill.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006376) "taskkill.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006376) "taskkill.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00006376)2c:Tbdd5,"Endermanch@Trololo.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetMetaDataInternalInterface_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FindAtom (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FindAtomW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AddAtom (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter AddAtomW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter WaitForInputIdleW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CLSIDFromProgIDEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter PlaySound (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00000760) "taskkill.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00004860) "taskkill.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00006376) "taskkill.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00006376)2d:T432,"Endermanch@Trololo.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "Endermanch@Trololo.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\VERSION.dll" - [base:0; Status:c0000135] "Endermanch@Trololo.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "Endermanch@Trololo.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\Gdiplus.dll" - [base:0; Status:c0000135] "Endermanch@Trololo.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "Endermanch@Trololo.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winmm.dll" - [base:0; Status:c0000135] "Endermanch@Trololo.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135]2e:T493,"Endermanch@Trololo.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2f:Tcf0,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00000760-00000C25-46866652] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" [Source: 00000000-00000760-00000C25-47120954] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\9833e30950e59154b7792b48938e4e97\mscorlib.ni.dll" [Source: 00000000-00000760-00000C25-47847148] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" [Source: 00000000-00000760-00000C25-47930479] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" [Source: 00000000-00000760-00000C25-48236943] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll" [Source: 00000000-00000760-00000C25-48304940] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\VERSION.dll" [Source: 00000000-00000760-00000C25-48455746] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System\893341977b084a7627561c147da39e0c\System.ni.dll" [Source: 00000000-00000760-00000C25-48575982] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Drawing\2c094d1b56df6b8c876057d130170612\System.Drawing.ni.dll" [Source: 00000000-00000760-00000C25-48621604] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\58e2621ea621f062372147f12c6c27f1\System.Windows.Forms.ni.dll" [Source: 00000000-00000760-00000C25-48678198] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll" [Source: 00000000-00000760-00000C25-49208129] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00000760-00000C25-49371828] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\Gdiplus.dll" [Source: 00000000-00000760-00000C25-49624154] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00000760-00000C25-50857063] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\culture.dll" [Source: 00000000-00000760-00000C25-51090194] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en-US\mscorrc.dll" [Source: 00000000-00000760-00000C25-51120957] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\en\mscorrc.dll" [Source: 00000000-00000760-00000C25-51152748] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll" [Source: 00000000-00000760-00000C25-51190131] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\winmm.dll" [Source: 00000000-00000760-00000C25-51305316] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\comctl32.dll" [Source: 00000000-00000760-00000C25-51721888] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00004860-00000C25-51690393]30:T732,"Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER32"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER32"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER"; Key: ""; Value: "")31:T85f,"Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{12D83BD7-CF12-46BE-8540-812710D3021C},1"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},22"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}"; Key: "DEVICESTATE"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: ""; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: "APPID"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{9C119480-DDC2-4954-A150-5BD240D454AD},1"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: "IDTYPE"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: "TRANSPORT"; Value: "") "Endermanch@Trololo.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: "QUERYFILE"; Value: "")32:T9b0,"Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\OLE32.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ole32.dll" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\VERSION.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\VERSION.dll" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\UXTHEME.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\uxtheme.dll" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\GDIPLUS.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Gdiplus.dll" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\DWRITE.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\DWrite.dll" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\TASKKILL.EXE" "Endermanch@Trololo.exe" trying to access non-existent file "C:\taskkill.exe" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\taskkill.exe" "Endermanch@Trololo.exe" trying to access non-existent file "taskkill.exe" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\SXS.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\sxs.dll" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.DLL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\OLEAUT32.dll" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\WINMM.DLL"33:T7dd,"Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\ENDERMANCH@TROLOLO.EXE.CONFIG" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\ENDERMANCH@TROLOLO.EXE.LOCAL" "Endermanch@Trololo.exe" trying to access non-existent file "C:\Endermanch@Trololo.exe.Local\" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\FUSION.LOCALGAC" "Endermanch@Trololo.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fusion.localgac" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\ENDERMANCH@TROLOLO.CONFIG" "Endermanch@Trololo.exe" trying to access non-existent file "C:\Endermanch@Trololo.config" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "Endermanch@Trololo.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Globalization\EN-US.NLP" "Endermanch@Trololo.exe" trying to access non-existent file "C:\WINDOWS\Globalization\en-us.nlp"34:T94b,"Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter C:\Endermanch@Trololo.INI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI (UID: 00000000-00000760) "Endermanch@Trololo.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.INI (UID: 00000000-00000760)35:T42a,"taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "7C00C5923634DA0100000000000000000000000002000000") "taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "858BCE923634DA0100000000000000000000000002000000") "taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "1B320DFC3634DA0100000000000000000000000002000000") "taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "64C617FC3634DA0100000000000000000000000002000000")36:T4ce,"Endermanch@Trololo.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "DISABLETASKMGR"; Value: "01000000") "taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "7C00C5923634DA0100000000000000000000000002000000") "taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "858BCE923634DA0100000000000000000000000002000000") "taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "1B320DFC3634DA0100000000000000000000000002000000") "taskkill.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "64C617FC3634DA0100000000000000000000000002000000")37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3AERERERERERERERERERERwBP/////////////////0cAT/////////////////9HAE//////////////////RwBP/////////////////0cAT/////////////////9HAE//////////////////RwBP/////////////////0cAT/////////////////9HAE//////////////////RwBP/////////////////0cAT/////////////////9HAE//////////////////RwBP/////////////////0cAT/////////////////9HAE//////////////////RwBP/////////////////0cAT/////////////////9HAE//////////////////RwBIiIiIiIiIiIiIiIiIiEcARERERERERERERERERERHAETExMTExMTExMTs7OSXRwBMzMzMzMzMzMzMzMzMzEAABEREREREREREREREREQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////////wAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAADwAAAB////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790272430574,"unified_at":"2026-09-24T17:53:50.574Z","metadata":{"hashes":{"sha256":"3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","sha1":"e50d4b7bf005075cb63d6bd9ad48c92a00ee9444","md5":"b6d61b516d41e209b207b41d91e3b90d","sha512":"3217fc904e4c71b399dd273786634a6a6c19064a9bf96960df9b3357001c12b9547813412173149f6185eb5d300492d290342ec955a8347c6f9dcac338c136da","ssdeep":"49152:lj3iZ1MHTIo3dLoYNiDSeP7jxPXyouZ3xtNg5EzN3CD70c5iMOIEQLx3+bt+g:lma9NLYGG7FduZhtau3Cv0cIIEQVubt9","ssdeep_chunks":["49152:lj3iZ1M","49152:j3iZ1MH","49152:3iZ1MHT","49152:iZ1MHTI","49152:Z1MHTIo","49152:1MHTIo3","49152:MHTIo3d","49152:HTIo3dL","49152:TIo3dLo","49152:Io3dLoY","49152:o3dLoYN","49152:3dLoYNi","49152:dLoYNiD","49152:LoYNiDS","49152:oYNiDSe","49152:YNiDSeP","49152:NiDSeP7","49152:iDSeP7j","49152:DSeP7jx","49152:SeP7jxP","49152:eP7jxPX","49152:P7jxPXy","49152:7jxPXyo","49152:jxPXyou","49152:xPXyouZ","49152:PXyouZ3","49152:XyouZ3x","49152:youZ3xt","49152:ouZ3xtN","49152:uZ3xtNg","49152:Z3xtNg5","49152:3xtNg5E","49152:xtNg5Ez","49152:tNg5EzN","49152:Ng5EzN3","49152:g5EzN3C","49152:5EzN3CD","49152:EzN3CD7","49152:zN3CD70","49152:N3CD70c","49152:3CD70c5","49152:CD70c5i","49152:D70c5iM","49152:70c5iMO","49152:0c5iMOI","49152:c5iMOIE","49152:5iMOIEQ","49152:iMOIEQL","49152:MOIEQLx","49152:OIEQLx3","49152:IEQLx3+","49152:EQLx3+b","49152:QLx3+bt","49152:Lx3+bt+","49152:x3+bt+g","98304:lj3iZ1M","98304:j3iZ1MH","98304:3iZ1MHT","98304:iZ1MHTI","98304:Z1MHTIo","98304:1MHTIo3","98304:MHTIo3d","98304:HTIo3dL","98304:TIo3dLo","98304:Io3dLoY","98304:o3dLoYN","98304:3dLoYNi","98304:dLoYNiD","98304:LoYNiDS","98304:oYNiDSe","98304:YNiDSeP","98304:NiDSeP7","98304:iDSeP7j","98304:DSeP7jx","98304:SeP7jxP","98304:eP7jxPX","98304:P7jxPXy","98304:7jxPXyo","98304:jxPXyou","98304:xPXyouZ","98304:PXyouZ3","98304:XyouZ3x","98304:youZ3xt","98304:ouZ3xtN","98304:uZ3xtNg","98304:Z3xtNg5","98304:3xtNg5E","98304:xtNg5Ez","98304:tNg5EzN","98304:Ng5EzN3","98304:g5EzN3C","98304:5EzN3CD","98304:EzN3CD7","98304:zN3CD70","98304:N3CD70c","98304:3CD70c5","98304:CD70c5i","98304:D70c5iM","98304:70c5iMO","98304:0c5iMOI","98304:c5iMOIE","98304:5iMOIEQ","98304:iMOIEQL","98304:MOIEQLx","98304:OIEQLx3","98304:IEQLx3+","98304:EQLx3+b","98304:QLx3+bt","98304:Lx3+bt+","98304:x3+bt+g","49152:lma9NLY","49152:ma9NLYG","49152:a9NLYGG","49152:9NLYGG7","49152:NLYGG7F","49152:LYGG7Fd","49152:YGG7Fdu","49152:GG7FduZ","49152:G7FduZh","49152:7FduZht","49152:FduZhta","49152:duZhtau","49152:uZhtau3","49152:Zhtau3C","49152:htau3Cv","49152:tau3Cv0","49152:au3Cv0c","49152:u3Cv0cI","49152:3Cv0cII","49152:Cv0cIIE","49152:v0cIIEQ","49152:0cIIEQV","49152:cIIEQVu","49152:IIEQVub","49152:IEQVubt","49152:EQVubt9"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"85bbc0ee5e7d7cd80c8493b12018312b547a612c"},"file_info":{"file_name":"Trololololo.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3136512,"entropy":7.44,"compile_timestamp":"2011-09-18T17:44:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295257000,"last_seen":1787845328000,"last_multi_scan":1787845328000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":4,"import_count":0,"export_count":0,"embedded_file_count":5,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":3130372,"raw_size":3130880},{"name":".sdata","virtual_address":"0x300000","virtual_size":143,"raw_size":512},{"name":".rsrc","virtual_address":"0x302000","virtual_size":3408,"raw_size":3584},{"name":".reloc","virtual_address":"0x304000","virtual_size":12,"raw_size":512}],"section_names":[".text",".sdata",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["endermanch","trololo","joke","malware","badjoke","fynloski","habbo","multiukh","olol","autorun","conficker","evasive"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":85,"suspicious_count":26,"malicious_count":15,"total":126},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Joke","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"PUA/Trololol.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILKrypt.32","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.MSIL-31","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILKrypt.32 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/BadJoke.AD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Joker.AD.qdxe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Disabler.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Windows_Malware_GenericWorm_PE_3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Killproc-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Generic.oe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.NRDN-0856","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Disabler.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.AD.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILKrypt.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"malicious","value":"Disables Windows Task Manager (taskmgr)"},{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/techniques/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Found encryption key used by malware in binary"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Disables Windows Task Manager (taskmgr)"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to copy files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"malicious","value":"Terminates system processes"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"taskkill.exe /f /im explorer.exe\" (Indicator: \"kill\"; Source: \"sample.bin\"), Found reference to API \"taskkill.exe /f /im taskmgr.exe\" (Indicator: \"kill\"; Source: \"sample.bin\"), Found reference to API \"WinForms_RecursiveFormCreate\" (Indicator: \"creat\"; Source: \"sample.bin\"), Found reference to API \"RegWrite\" (Indicator: \"write\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"read\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"time\"; Source: \"sample.bin\"), Found reference to API \"ttee\" (Indicator: \"tee\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"REG add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v DisableTaskMgr /t REG_DWORD /d 0 /f\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"taskkill.exe /f /im explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"taskkill.exe /f /im explorer.exe\" (Indicator: \"taskkill.exe\"; Source: \"sample.bin\"), Found string \"taskkill.exe /f /im taskmgr.exe\" (Indicator: \"taskmgr.exe\"; Source: \"sample.bin\"), Found string \"taskkill.exe /f /im taskmgr.exe\" (Indicator: \"taskkill.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"128.177.96.51:80\"\n \"128.177.96.43:80\"\n \"23.60.133.163:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\Alexander\\Documents\\Visual Studio 2008\\Projects\\Virus\\Virus\\obj\\Release\\Virus.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"},{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.47040979912","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"},{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"Virus.My\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"},{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 128.177.96.51 on port 80 is sent without HTTP header\n TCP traffic to 128.177.96.43 on port 80 is sent without HTTP header\n TCP traffic to 23.60.133.163 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/55 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"},{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/55 Antivirus vendors marked sample as malicious (87% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"},{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$25","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$26","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 69C40000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"GetCatalogObject@CLBCatQ.DLL\"\n \"GetCatalogObject2@CLBCatQ.DLL\"\n \"SxsLookupClrGuid@sxs.dll\"\n \"SxsOleAut32RedirectTypeLibrary@sxs.dll\"\n \"RegOpenKeyW@ADVAPI32.dll\"\n \"RegQueryValueW@ADVAPI32.dll\"\n \"SxsOleAut32MapConfiguredClsidToReferenceClsid@sxs.dll\"\n \"LookupAccountNameLocalW@sechost.dll\"\n \"LookupAccountSidW@ADVAPI32.dll\"\n \"LookupAccountSidLocalW@sechost.dll\"\n \"CryptAcquireContextW@CRYPTSP.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"\n \"CPSetKeyParam@rsaenh.dll\"\n \"CPGetKeyParam@rsaenh.dll\"\n \"CPExportKey@rsaenh.dll\"\n \"CPImportKey@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00138843-00002740)\n Spawned process \"taskkill.exe\" with commandline \"/f /im explorer.exe\" (UID: 00287406-00003376)\n Spawned process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00288796-00003544)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00133578-00002508-76F4228D-141030","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceW@SECHOST.DLL at 00133578-00002508-76F4228D-141590","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00133578-00002508-76F261F8-141089","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\system32\\wshom.ocx\"\n \"\" created file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" created file \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp\"\n \"\" created file \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp\"\n \"\" created file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll\"\n \"\" created file \"%WINDIR%\\system32\\wdmaud.drv\"\n \"\" created file \"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui\"\n \"\" created file \"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"BFFF098A\" to virtual address \"0x6A7E1FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using taskkill","description":"Process \"taskkill.exe\" with commandline \"/f /im explorer.exe\" (UID: 00137531-00002616)\n Process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00138843-00002740)\n Process \"taskkill.exe\" with commandline \"/f /im explorer.exe\" (UID: 00287406-00003376)\n Process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00288796-00003544)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"taskkill.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"taskkill.exe\" (PID: 00002616)\n \"\" wrote 52 bytes to a foreign process \"taskkill.exe\" (PID: 00002616)\n \"\" wrote 4 bytes to a foreign process \"taskkill.exe\" (PID: 00002616)\n \"\" wrote 32 bytes to a foreign process \"taskkill.exe\" (PID: 00002740)\n \"\" wrote 52 bytes to a foreign process \"taskkill.exe\" (PID: 00002740)\n \"\" wrote 4 bytes to a foreign process \"taskkill.exe\" (PID: 00002740)\n \"\" wrote 32 bytes to a foreign process \"taskkill.exe\" (PID: 00003376)\n \"\" wrote 52 bytes to a foreign process \"taskkill.exe\" (PID: 00003376)\n \"\" wrote 4 bytes to a foreign process \"taskkill.exe\" (PID: 00003376)\n \"\" wrote 32 bytes to a foreign process \"taskkill.exe\" (PID: 00003544)\n \"\" wrote 52 bytes to a foreign process \"taskkill.exe\" (PID: 00003544)\n \"\" wrote 4 bytes to a foreign process \"taskkill.exe\" (PID: 00003544)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Disables Windows Task Manager (taskmgr)","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"DISABLETASKMGR\"; Value: \"01000000\")","origin":"Registry Access","relevance":9,"id":"registry-3","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00133578-00002508)\n Spawned process \"taskkill.exe\" with commandline \"/f /im explorer.exe\" (UID: 00137531-00002616)\n Spawned process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00138843-00002740)\n Spawned process \"taskkill.exe\" with commandline \"/f /im explorer.exe\" (UID: 00287406-00003376)\n Spawned process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00288796-00003544)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Windows Script Host Shell Object\" (Path: \"HKCU\\CLSID\\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\")\n \"taskkill.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"taskkill.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\")\n \"taskkill.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\")\n \"taskkill.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"taskkill.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")\n \"taskkill.exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKCU\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"taskkill.exe\" (UID: 00031372-00003140) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"taskkill.exe\" (UID: 00031372-00003140) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"taskkill.exe\" with commandline \"/f /im explorer.exe\" (UID: 00031372-00003140)\n Spawned process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00031379-00003344)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"taskkill.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\".exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\taskkill.exe\", Handle: )\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\taskkill.exe\", Handle: 624)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\taskkill.exe\", Handle: 636)\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\taskkill.exe\", Handle: 768)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 604928)\n \"taskkill.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 4255231744)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"/f /im explorer.exe\" (UID: 00031372-00003140)\n Process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00031379-00003344)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\WindowsShell.Manifest\"\n \".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"malicious","category":"System Security","name":"Terminates system processes","description":"Process \"taskkill.exe\" with commandline \"/f /im taskmgr.exe\" (UID: 00031379-00003344)","origin":"Monitored Target","relevance":10,"id":"target-39","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.18/32, 192.168.240.33/32, 192.168.240.81/32, 192.168.240.219/32, 192.168.240.234/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00000760-00000BC0-48164895\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"Endermanch@Trololo.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"Endermanch@Trololo.exe has big resource with name: \"trololol\" size: \"3113186\" and abnormal entropy:\"7.47212144648\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"^ ^ q\" (Indicator: \" ^ \"; File: \"Endermanch@Trololo.exe\")\n Found string \"!\"!\"^ ^ A\" (Indicator: \" ^ \"; File: \"Endermanch@Trololo.exe\")\n Found string \"^ ^ Y)Y)\" (Indicator: \" ^ \"; File: \"Endermanch@Trololo.exe\")\n Found string \"^ ^ | | Q Q\" (Indicator: \" ^ \"; File: \"Endermanch@Trololo.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.468127709824534","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Found encryption key used by malware in binary\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Endermanch@Trololo.exe\" called \"IsWow64Process\" with parameter \"760\" - (UID: 00000000-00000760)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"taskkill.exe\" called \"EnumWindows\" with parameter \"376042945408\" - (UID: 00000000-00004860)\n \"taskkill.exe\" called \"EnumWindows\" with parameter \"124717103344\" - (UID: 00000000-00006376)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Endermanch@Trololo.exe\" called \"GetWindowTextW\" with parameter \"TRRRROROROLOLOLOLOLOL\" - (UID: 00000000-00000760)\n \"Endermanch@Trololo.exe\" called \"GetWindowTextW\" with parameter \"TROLOLOLOLOL\" - (UID: 00000000-00000760)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Endermanch@Trololo.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000760)\n \"taskkill.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004860)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Endermanch@Trololo.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00000760)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Endermanch@Trololo.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00000760)\n \"Endermanch@Trololo.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000760)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Endermanch@Trololo.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Endermanch@Trololo.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"CExpandEnvironmentStrings\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"explorer.exe\")\"\n \"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"taskmgr.exe\")\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Endermanch@Trololo.exe\" called \"CreateProcessW\" with parameter \"taskkill.exe /f /im explorer.exe\" - (UID: 00000000-00000760)\n \"Endermanch@Trololo.exe\" called \"CreateProcessW\" with parameter \"taskkill.exe /f /im taskmgr.exe\" - (UID: 00000000-00000760)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"MoveFile\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")\n Found reference to API (Indicator: \"CopyFile\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\MidiMapper_modLongMessage_RefCnt\"\n \"Local\\SM0:760:304:WilStaging_02\"\n \"SM0:760:304:WilStaging_02\"\n \"SM0:760:120:WilError_01\"\n \"MidiMapper_modLongMessage_RefCnt\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:760:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:760:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:760:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:4860:304:WilStaging_02\"\n \"SM0:4860:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:6376:304:WilStaging_02\"\n \"SM0:6376:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Endermanch@Trololo.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Endermanch@Trololo.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 82EF0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 82EF0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 82940000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Endermanch@Trololo.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 83FC0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 83FC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Endermanch@Trololo.exe\" was detected as \".NET\" and name: \"Library\"\n \"Endermanch@Trololo.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"Endermanch@Trololo.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Endermanch@Trololo.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Endermanch@Trololo.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Endermanch@Trololo.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Endermanch@Trololo.exe\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2fc600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2fc404\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\taskkill.exe\" [Source: 00000000-00000760-00000BC0-50165348]\n Observed system executable string:\"%WINDIR%\\System32\\VBoxService.exe\" [Source: 00000000-00004860-00000455-10154012218]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Endermanch@Trololo.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Endermanch@Trololo.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"taskkill.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Endermanch@Trololo.exe\" queries basic process information of the \"C:\\Endermanch@Trololo.exe\" (UID: 760)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Endermanch@Trololo.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config\"\n \"Endermanch@Trololo.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"Endermanch@Trololo.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Endermanch@Trololo.exe\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Endermanch@Trololo.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"Endermanch@Trololo.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\":\\windows\\system32\\midimap.dll\" [Source: 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp\n 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp]\n Observed email domain:\"midimap.dll\" [Source: 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp\n 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json12/21\" - Source: \"00000000-00000760.00000000.67610.03100000.00000002.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,012/21\" - Source: \"00000000-00000760.00000000.67610.03100000.00000002.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00000760.00000001.69529.02DC0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json12/21\" - Source: \"00000000-00000760.00000002.71450.03100000.00000002.mdmp\")\n Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,012/21\" - Source: \"00000000-00000760.00000002.71450.03100000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE4C527CA26FF14D06E63AE27422F3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"cx\": \"1\"\n \"cy\": \"1\"}\n \"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1694566619\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2046887813\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"453051687\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845111\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2046887813\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"453051687\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Endermanch@Trololo.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"117508391\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Endermanch@Trololo.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"taskkill.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"Microsoft.VisualBasic.Devices::Computer\" and MemberReference \"get_Screen\" in \"Endermanch@Trololo.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegReadW\" (Indicator: \"RegRead\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Enter stop password:\" (Indicator: \"password\"; File: \"Endermanch@Trololo.exe\")\n Found string \"passwordForm/\" (Indicator: \"password\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"Endermanch@Trololo.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"taskkill.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004860)\n \"taskkill.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006376)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")\n Found string \"}|\\Device\\HarddiskVolume2\\Endermanch@Trololo.exe%b{00000000-0000-0000-0000-000000000000}|1%b760\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000760.00000001.69529.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000760.00000000.67610.02DC0000.00000004.mdmp, 00000000-00000760.00000001.69529.02DC0000.00000004.mdmp, 00000000-00000760.00000002.71450.02DC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$35","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"Endermanch@Trololo.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FONTCACHE\\PARAMETERS\"; Key: \"CLIENTCACHESIZE\"; Value: \"\")\n \"Endermanch@Trololo.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\TASKKILL.EXE\"; Value: \"\")\n \"taskkill.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"taskkill.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")\n \"taskkill.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"HOSTNAME\"; Value: \"\")\n \"taskkill.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\"; Key: \"DOMAIN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Endermanch@Trololo.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"explorer.exe\")\"\n \"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"taskmgr.exe\")\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"4/90 reputation engines marked \"http://wscript.shell\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"endermanch@trololo.ini\"\n Pattern match: \"endermanch@trololo.exe\"\n Pattern match: \"asllog_apphelpdebug_endermanch@trololo.exe_760.txt\"\n Pattern match: \"asllog_shimengstate_endermanch@trololo.exe_760.txt\"\n Pattern match: \"asllog_shimdebuglog_endermanch@trololo.exe_760.txt\"\n Pattern match: \"manch@trololo.exe\"\n Pattern match: \"endermanch@trololo.exe.log\"\n Pattern match: \"endermanch@trololo.config\"\n Pattern match: \"ndermanch@trololo.exe\"\n Pattern match: \"ndermanch@trol.exe\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"General","name":"Found encryption key used by malware in binary","description":"\"sample.bin\" contain encryption key b'\\xe7\\x00\\xe5\\x00' at (Offset: 2953315)","origin":"Binary File","mitre_attack_id":"T1027","relevance":10,"id":"binary-54","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex(System.Int32) at b6d61b516d41e209b207b41d91e3b90d-6000021-Form1~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at b6d61b516d41e209b207b41d91e3b90d-6000032-Form2~InitializeComponent\n Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at b6d61b516d41e209b207b41d91e3b90d-600002f-Form1~Form1_Load","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Endermanch@Trololo.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"Endermanch@Trololo.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"Endermanch@Trololo.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"Endermanch@Trololo.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"Endermanch@Trololo.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"Endermanch@Trololo.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000760)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"explorer.exe\")\"\n \"taskkill.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = \"taskmgr.exe\")\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]}],"intel_graph":{"map":{"File:3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe":{"type":"File","value":"3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:128.177.96.43":{"type":"Ip","value":"128.177.96.43"},"Ip:128.177.96.51":{"type":"Ip","value":"128.177.96.51"},"Ip:23.60.133.163":{"type":"Ip","value":"23.60.133.163"}},"chains":[{"id":"1542559869331287113","root":"File:3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]}},{"id":"sandbox_network","root":"File:3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","edges":[{"edge_kind":"contacted_ip","from_key":"File:3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","to_key":"Ip:128.177.96.51"},{"edge_kind":"contacted_ip","from_key":"File:3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","to_key":"Ip:128.177.96.43"},{"edge_kind":"contacted_ip","from_key":"File:3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","to_key":"Ip:23.60.133.163"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":128,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":414,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["endermanch","trololo","joke","malware","badjoke","fynloski","habbo","multiukh","olol","autorun","conficker","evasive"],"sample_flags":["Network Traffic","Sample Crashed","Sample not shared","User Comment","TOR analysis"],"sandbox_reports":[{"id":"65847ad72154cc45440990b7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.MSILKrypt","submit_name":"Endermanch@Trololo.exe","analysis_start_time":"2023-12-21T17:50:15+00:00","indicators_count":{"informative":80,"suspicious":19,"malicious":8},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5d69611a028838635e7b24ec","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.MSILKrypt","submit_name":"L7.exe","analysis_start_time":"2019-08-30T17:44:24+00:00","indicators_count":{"informative":10,"suspicious":12,"malicious":8},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5cfe87fb0288380c97ac6293","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"Trojan.MSIL.Disabler","submit_name":"Virus.exe","analysis_start_time":"2019-06-10T16:39:31+00:00","indicators_count":{"informative":3,"suspicious":1,"malicious":3},"tags":["User Comment"],"is_in_unified_schema":false},{"id":"5c33b8ab7ca3e130bc5ec003","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.MSILKrypt","submit_name":"Virus.exe","analysis_start_time":"2019-01-09T15:38:33+00:00","indicators_count":{"informative":11,"suspicious":11,"malicious":8},"tags":["User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"57041659aac2edff443ca2c4","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.MSILKrypt","submit_name":"Trololololo.exe","analysis_start_time":"2016-04-05T14:57:27+00:00","indicators_count":{"informative":7,"suspicious":9,"malicious":8},"tags":["Sample not shared","User Comment"],"is_in_unified_schema":true},{"id":"55d09b7d0e316d1429e4548d","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":97,"malware_family":"Gen:Variant.MSILKrypt","contacted_countries":["USA"],"submit_name":"Trololololo.exe","analysis_start_time":"2015-08-16T09:18:33+00:00","indicators_count":{"informative":2,"suspicious":3,"malicious":3},"tags":["Network Traffic","Sample Crashed","Sample not shared","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"128.177.96.51","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"}]},{"address":"128.177.96.43","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"}]},{"address":"23.60.133.163","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d09b7d0e316d1429e4548d"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}],"processes":[{"pid":760,"ppid":0,"name":"Endermanch@Trololo.exe","command_line":"","sha256":"3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe","normalized_path":"C:\\Endermanch@Trololo.exe","uid":"00000000-00000760","icon":"$37"},{"pid":4860,"ppid":760,"name":"taskkill.exe","command_line":"/f /im explorer.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00000760","uid":"00000000-00004860"},{"pid":6376,"ppid":760,"name":"taskkill.exe","command_line":"/f /im taskmgr.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00000760","uid":"00000000-00006376"},{"pid":2484,"ppid":760,"name":"taskkill.exe","command_line":"/f /im explorer.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00000760","uid":"00000000-00002484"},{"pid":7164,"ppid":760,"name":"taskkill.exe","command_line":"/f /im taskmgr.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00000760","uid":"00000000-00007164"},{"pid":5792,"ppid":760,"name":"taskkill.exe","command_line":"/f /im explorer.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00000760","uid":"00000000-00005792"}],"all_imported_dlls":["CRYPTBASE.dll","WS2_32.dll","ntdll.dll","SETUPAPI.dll","uxtheme.dll","midimap.dll","Secur32.dll","MPR.dll","AUDIOSES.DLL","wkscli.dll","NETAPI32.dll","DEVOBJ.dll","RPCRT4.dll","mscorwks.dll","mscorjit.dll","System.Runtime.Remoting.ni.dll","srvcli.dll","dbghelp.dll","wbemprox.dll","IMM32.DLL","USER32.dll","CFGMGR32.dll","LPK.dll","GDI32.dll","KERNEL32.dll","OLEAUT32.dll","ADVAPI32.dll","mscorlib.ni.dll","sxs.dll","SSPICLI.DLL","framedynos.dll","dwmapi.dll","apphelp.dll","gdiplus.dll","msvcrt.dll","System.Drawing.ni.dll","MMDevAPI.DLL","USP10.dll","MSCTF.dll","CLBCatQ.DLL","winmm.dll","fastprox.dll","PSAPI.DLL","profapi.dll","System.Windows.Forms.ni.dll","netutils.dll","WTSAPI32.dll","Winsta.dll","rsaenh.dll","kernel32.dll","ole32.dll","MSCOREE.DLL","VERSION.dll","System.ni.dll","culture.dll","NSI.dll","wbemsvc.dll","sechost.dll","shell32.dll","mscoreei.dll","Microsoft.VisualBasic.ni.dll","comctl32.dll","CRYPTSP.dll","RpcRtRemote.dll","SspiCli.dll","KERNELBASE.dll","SHLWAPI.dll","nsi.dll","gdi32.dll","rpcss.dll","mpr.dll","imm32.dll","version.dll","clbcatq.dll","wbemcomn.dll","winsta.dll","usp10.dll","secur32.dll","ntdsapi.dll","mscoree.dll","advapi32.dll","mscorrc.dll","cryptbase.dll","rpcrt4.dll","user32.dll","ws2_32.dll","oleaut32.dll","MMDevAPI.dll","msctf.dll","sspicli.dll","netapi32.dll","shlwapi.dll","GdiPlus.dll","lpk.dll","msvcr80.dll","Culture.dll","propsys.dll","wtsapi32.dll","KernelBase.dll","scrrun.dll","cryptsp.dll","System.Windows.Forms.dll","ksuser.dll","avrt.dll","devobj.dll","TextInputFramework.dll","bcrypt.dll","AudioSes.dll","msacm32.dll","win32u.dll","powrprof.dll","combase.dll","ntmarta.dll","gdi32full.dll","bcryptprimitives.dll","kernel.appcore.dll","SHCore.dll","windows.storage.dll","CoreMessaging.dll","WinTypes.dll","CoreUIComponents.dll","fltLib.dll","VxSSL64.dll","cfgmgr32.dll","DWrite.dll","ucrtbase.dll","msvcp_win.dll","winmmbase.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%SAMPLEDIR%\\Trololololo.exe.config","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"},{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%SAMPLEDIR%\\Trololololo.exe","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\FONTS\\VERDANA.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\VERDANAB.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\VERDANAI.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\MSJH.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\TAHOMA.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\VERDANAZ.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\MSYH.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\MALGUN.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\MICROSS.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\system32\\taskkill.exe","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\system32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index2b5.dat","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Fonts\\msyh.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\micross.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Fonts\\verdana.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\verdanab.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\verdanai.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\verdanaz.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\msjh.ttf","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"C:\\3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe.exe.config","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"C:\\3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe.exe","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"}]},{"path":"%WINDIR%\\Fonts\\marlett.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\batang.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cour.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\couri.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Vanib.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\gulim.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\impact.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\iskpota.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\iskpotab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kalinga.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kalingab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\malgunbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\mangal.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\mangalb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\meiryo.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\meiryob.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\msjhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\msyhbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\mingliu.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\mingliub.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\monbaiti.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\msgothic.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\plantc.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\raavi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\raavib.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoesc.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoescb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\sylfaen.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\taile.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\taileb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\tunga.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\tungab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\vrinda.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"C:\\L7.exe.config","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"C:\\L7.exe","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\vrindab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Shonar.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Shonarb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\msyi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\tahomabd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsa.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simhei.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simkai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsau.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsaui.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsaub.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsauz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browa.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browaz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browau.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browaui.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browaub.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\browauz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordiau.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordiaub.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordiauz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcdi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcdb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcil.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcii.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcib.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcibi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcjl.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcji.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcjb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kaiu.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\l_10646.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\calibri.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\calibrii.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\calibrib.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\calibriz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cambria.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cambriai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cambriab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cambriaz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Candara.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\consolai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\consolab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\consolaz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\constan.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\constani.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\constanb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\constanz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\corbel.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\corbeli.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\corbelb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\corbelz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\framd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\framdit.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\trebucbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\trebucbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\webdings.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\coure.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\serife.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\sserife.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\smalle.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\smallf.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\calibrili.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\calibril.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\NIRMALA.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\NIRMALAB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\AGENCYB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\AGENCYR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ALGER.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ANTQUABI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ANTQUAI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ARLRDBD.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BASKVILL.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BAUHS93.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BELL.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BELLB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index357.dat","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BKANT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_B.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_BI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_BLAR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_CB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_CBI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_CI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_CR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_I.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_PSTC.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOD_R.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOOKOS.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSBI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BOOKOSI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BRADHITC.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BRITANIC.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BRLNSB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BRLNSDB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BRLNSR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BROADW.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BRUSHSCI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CALIFB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CALIFI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CALIFR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CALIST.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CALISTB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CALISTBI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\assembly\\pubpol205.dat","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CALISTI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CASTELAR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CENSCBK.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CENTAUR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CENTURY.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CHILLER.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\COLONNA.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\COOPBL.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\COPRGTB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\COPRGTL.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\CURLZ___.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ELEPHNTI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ENGR.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ERASLGHT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ERASMD.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FELIXTI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FORTE.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRABK.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRABKIT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRADM.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRADMCN.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRADMIT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRAHV.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRAHVIT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRAMDCN.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FREESCPT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GARAIT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GIGI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\courbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\courbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\daunpenh.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\dokchamp.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\estre.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\euphemia.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\gautami.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\gautamib.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Vani.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kartika.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kartikab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\KhmerUI.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\KhmerUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\LaoUI.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\LaoUIb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\latha.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\lathab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\lucon.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\himalaya.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\msmincho.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\mvboli.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ntailu.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ntailub.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\nyala.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\phagspa.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\phagspab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\shruti.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\shrutib.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simsunb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\angsaz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\aparaj.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\aparajb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\aparajbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\aparaji.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordia.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordiai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordiab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ebrima.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ebrimabd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\gisha.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\gishabd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kokila.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kokilab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kokilabi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\kokilai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\leelawad.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\leelawdb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\msuighur.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\moolbor.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\symbol.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\utsaah.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\utsaahb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\utsaahbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\utsaahi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\vijaya.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\vijayab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\wingding.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\modern.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\roman.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\script.fon","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\andlso.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\arabtype.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simpo.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simpbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simpfxo.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\majalla.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\majallab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\trado.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\tradbdo.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ahronbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\david.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\davidbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\frank.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\lvnm.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\lvnmbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\mriam.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\mriamc.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\nrkis.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\rod.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\simfang.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\cordiaui.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcdl.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcdbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcel.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcei.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upceb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcebi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcfl.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcfi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcfb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcfbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcjbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upckl.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcki.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upckb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upckbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcll.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upcli.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upclb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\upclbi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Candarai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Candarab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Candaraz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\comic.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\comicbd.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\consola.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\Gabriola.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\georgia.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\georgiai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\georgiab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\georgiaz.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\pala.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\palai.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\palab.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\palabi.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoepr.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\segoeprb.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\trebuc.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\trebucit.ttf","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BELLI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\BERNHC.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ERASBD.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\ERASDEMI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FRSCRIPT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\FTLTLT.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GADUGI.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GADUGIB.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GARA.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GARABD.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GIL_____.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GILB____.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GILBI___.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%WINDIR%\\Fonts\\GILC____.TTF","sources":[{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"},{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"57041659aac2edff443ca2c4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5c33b8ab7ca3e130bc5ec003"},{"report_type":"sandbox","report_id":"5d69611a028838635e7b24ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"Local\\SM0:760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"SM0:760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"SM0:760:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:760:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"SM0:4860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]},{"name":"SM0:6376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65847ad72154cc45440990b7"}]}]}},"report_ids":{"sandbox_job_ids":["65847ad72154cc45440990b7","5d69611a028838635e7b24ec","5c33b8ab7ca3e130bc5ec003","57041659aac2edff443ca2c4","55d09b7d0e316d1429e4548d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSILKrypt.Generic Sample 3d0efd55bde5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3d0efd55bde5…. Malware family: MSILKrypt.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILKrypt.Generic Sample 3d0efd55bde5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3d0efd55bde5…. Malware family: MSILKrypt.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILKrypt.Generic Sample 3d0efd55bde5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3d0efd55bde5…. Malware family: MSILKrypt.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]