34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 68:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 3d3a49ebbfeb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3d3a49ebbfeb…. Malware family: Zusy.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 15 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f"],"about":{"@type":"SoftwareApplication","name":"3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4d4,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000956.00000000.140291.19D40000.00000004.mdmp, 00000000-00000956.00000001.140540.19D40000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00000956.00000000.140291.19D40000.00000004.mdmp, 00000000-00000956.00000001.140540.19D40000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00000956.00000000.140291.19D40000.00000004.mdmp, 00000000-00000956.00000001.140540.19D40000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp, 00000000-00000956.00000001.140540.34750000.00000004.mdmp")37:T53c,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")38:T823,Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")39:T867,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")3a:T4a6,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")3b:Tac0,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\HARDWAREEVENTS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\HARDWAREEVENTS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\HARDWAREEVENTS\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS\POWERSHELL")3c:Ta0d,"9iqmgvw,czcthawte," - Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e[" - Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pbton1micratiotion1l0j" - Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000956.00000000.140291.34130000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000956.00000000.140291.34650000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00000956.00000001.140540.34130000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e[" - Source: "00000000-00000956.00000001.140540.34130000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000956.00000001.140540.34195000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000956.00000001.140540.34195000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00000956.00000001.140540.34195000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000956.00000001.140540.34195000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000956.00000001.140540.3420B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrd__198" (Indicator: "base64"; Source: "00000000-00000956.00000000.140291.22640000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00000956.00000000.140291.22640000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00000956.00000000.140291.22640000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00000956.00000000.140291.22640000.00000004.mdmp")5f:Tdfe,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")60:T72c,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")61:T7b1,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")62:T445,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")63:T755,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000956.00000000.140291.22560000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000956.00000000.140291.22580000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000956.00000000.140291.22580000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000956.00000000.140291.22640000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000956.00000000.140291.22640000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000956.00000000.140291.22640000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000956.00000001.140540.225A0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000956.00000001.140540.225A0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000956.00000001.140540.22600000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00000956.00000001.140540.22690000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00000956.00000001.140540.22690000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000956.00000001.140540.34750000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000956.00000001.140540.34750000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000956.00000001.140540.34750000.00000004.mdmp")64:T7db,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000956.00000000.140291.19D40000.00000004.mdmp, 00000000-00000956.00000001.140540.19D40000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000956.00000000.140291.19D40000.00000004.mdmp, 00000000-00000956.00000001.140540.19D40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00002516.00000000.143696.637B0000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00002896.00000000.143162.39F20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00003120.00000000.144020.44570000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004660.00000000.144671.A0DA0000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004800.00000000.139210.3AA80000.00000004.mdmp, 00000000-00004800.00000001.141129.3AA80000.00000004.mdmp, 00000000-00004800.00000002.142862.3AA80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f.bin.exe" (Indicator: "\Device\"; Source: "00000000-00004800.00000000.139210.3AA80000.00000004.mdmp, 00000000-00004800.00000001.141129.3AA80000.00000004.mdmp, 00000000-00004800.00000002.142862.3AA80000.00000004.mdmp")65:T59b,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000956.00000000.140291.4153A000.00000002.mdmp, 00000000-00000956.00000000.140291.9C912000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002516.00000000.143696.63AD1000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002896.00000000.143162.39EF6000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004660.00000000.144671.A0F91000.00000040.mdmp")66:T761,"