26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware.SLcbg.Generic Sample 3e617b7cf7f9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3e617b7cf7f9…. Malware family: Malware.SLcbg.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","keywords":["Malicious","Malware.SLcbg.Generic","malware analysis","sandbox report","threat intelligence","3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c"],"about":{"@type":"SoftwareApplication","name":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec2013254988.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware.SLcbg.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T410,Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; Source: "00000000-00005204-00000C2B-2307754207") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00005204-00000C2B-2307754258") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005204-00000C2B-2310286041") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005204-00000C2B-2310286079") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "findwindow"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp")28:T27a3,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000048e5df000000000018000000000000007cda3d913e0c0000ff7d2001000000001900000000000000e0e4df0000000000f0541f010000000000792001000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000cbebff7f0000f40f76401e0a0000e046cbebff7f0000007e2001000000009806ccebff7f0000408a2001000000000000ade9ff7f00000000000000000000e046cbebff7f00000300000000000000f38501ecff7f00006e47cbebff7f0000276601ecff7f000020e5df00 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c93865e9ff7f00008000000000000000000000000000000070adc51b00000000103304ecff7f000000000000000000000000021c0000000010c4df0000000000104162e9ff7f0000b0c92c0100000000d0c3df0000000000000000000000000000000000000000000100000000000000b84062e9ff7f0000060000000000000001000000000000000000021c000000003b4d76e9ff7f0000000000000000000088c8df00000000000000000000000000d02a141c0000000010b37a1c00000000e8f861e9ff7f000010b37a1c00000000d02a141c000000000d000000000000000d00000000000000a0f66a1c00000000f5870f1c00000000d02a141c (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000050dbc51b00000000aa47c81b00000000c046c81b00000000f89fdf0000000000e89fdf0000000000e89fdf0001000000f8a1df00000000004873a1ebff7f0000000000000000000050dbc51b00000000ef5e5ae7ff7f0000801dabe7ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000006647c81b000000007c47c81b000000006647c81b00000000aa47c81b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006647c81b (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000b0dac51b00000000bc48c81b00000000d047c81b00000000f89fdf0000000000e89fdf0000000000e89fdf0001000000f8a1df00000000004873a1ebff7f00000000000000000000b0dac51b00000000ef5e5ae7ff7f0000801dabe7ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000007648c81b000000008e48c81b000000007648c81b00000000bc48c81b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007648c81b (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f0dbc51b0000000048e32c010000000060e22c0100000000f89fdf0000000000e89fdf0000000000e89fdf0001000000f8a1df00000000004873a1ebff7f00000000000000000000f0dbc51b00000000ef5e5ae7ff7f0000801dabe7ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000006e32c01000000001ae32c010000000006e32c010000000048e32c010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006e32c01 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000d0f1c51b000000004c52c81b000000006051c81b00000000f89fdf0000000000e89fdf0000000000e89fdf0001000000f8a1df00000000004873a1ebff7f00000000000000000000d0f1c51b00000000ef5e5ae7ff7f0000801dabe7ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000652c81b000000001e52c81b000000000652c81b000000004c52c81b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000652c81b (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000060f3c51b000000001a3ec81b00000000303dc81b00000000f89fdf0000000000e89fdf0000000000e89fdf0001000000f8a1df00000000004873a1ebff7f0000000000000000000060f3c51b00000000ef5e5ae7ff7f0000801dabe7ff7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d63dc81b00000000ec3dc81b00000000d63dc81b000000001a3ec81b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d63dc81b (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000c0f7c51b000000006c43c81b000000008042c81b00000000000000000000000000000000000000000000000001000000f8a1df00000000004873a1ebff7f00000000000000000000c0f7c51b00000000ef5e5ae7ff7f0000801dabe7ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000002643c81b000000003e43c81b000000002643c81b000000006c43c81b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002643c81b (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000030f1c51b000000006c43c81b000000008042c81b00000000f89fdf0000000000e89fdf0000000000e89fdf0001000000f8a1df00000000004873a1ebff7f0000000000000000000030f1c51b00000000ef5e5ae7ff7f0000801dabe7ff7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000002643c81b000000003e43c81b000000002643c81b000000006c43c81b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002643c81b (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "Dllhost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000008e74f00000000001800000000000000c5d8a8ee054e00001fcb5300000000001f00000000000000a0e64f0000000000705652000000000000c55300000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000cbebff7f0000d20a26cfc1170000e046cbebff7f000020cb5300000000009806ccebff7f0000b0195300000000000000ade9ff7f00000000000000000000e046cbebff7f00000300000000000000f38501ecff7f00006e47cbebff7f0000276601ecff7f0000e0e64f00 (UID: 00000000-00005204) "Dllhost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005204) "Dllhost.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005204)29:T5da,"Dllhost.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000020146602000000000000000000000000000000000000000084e8630200000000201466020000000074e86302000000008000000000000000000000000000000024f044b6ff7f00000000000000000000100000000000000070f1f41a000000000000f51a0000000010000000000000006f5b6ddeff7f00001f000000 (UID: 00000000-00005204) "Dllhost.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000098a5f51a0000000000000000000000000300000000000000ffffffff00000000201466020000000098ea630200000000100000000000000000ea63020000000024f044b6ff7f0000000000000000000010000000000000000000000000000000000084a5ff7f000010000000000000006f5b6ddeff7f000000000000 (UID: 00000000-00005204) "Dllhost.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000e0ea6302000000000000000000000000ffffffff00000000f8197202000000002014660200000000e0ea630200000000b0df710200000000030000000000000024f044b6ff7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b6ddeff7f0000ffffffff (UID: 00000000-00005204) "Dllhost.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000020eb6302000000000000000000000000ffffffff00000000f819720200000000201466020000000020eb630200000000b0df710200000000030000000000000024f044b6ff7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5b6ddeff7f0000ffffffff (UID: 00000000-00005204)2a:T7c4,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "12003204690,2896,105,,GetForegroundWindow,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "12003276894,2896,108,,GetWindowTextA,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "12000094596,2896,105,,GetForegroundWindow,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp")2b:T467b,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002952) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %TEMP%\ntdll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %TEMP%\avicap32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\CustomMarshalers\4e262e951071d2394f40ffeede049f05\CustomMarshalers.ni.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005204) "Dllhost.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005204) "Server.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00009496) "Server.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008236)2c:T10153,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002952) "Dllhost.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SendMessageTimeout (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SendMessageTimeoutA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WaitForInputIdleW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetProcessWorkingSetSize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetProcessWorkingSetSizeW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetProcessWorkingSetSize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetProcessWorkingSetSizeW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetWindowTextLengthA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter capGetDriverDescriptionA (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter MkParseDisplayName (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter BindMoniker (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005204) "Dllhost.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005204) "Server.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00009496) "Server.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004368) "Server.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004368) "Server.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008236) "Server.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008236) "Server.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00008236) "Server.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00008236) "Server.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008236) "Server.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009212)2d:Te27,Found reference to API (Indicator: "MessageBox"; File: "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00002952.00000000.211500.00CB2000.00000002.mdmp, 00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformation"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfo"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "FindWindowA"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp")2e:Taa2,"Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000019-cctor "Software\\" in Source: 6000025-OK~DLV "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002952.00000000.211500.03280000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002952.00000000.211500.03280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002952.00000000.211500.03280000.00000004.mdmp "e\Software\C" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "y\Machine\Software\Classes\SystemFileAssociations\.e@" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\Software\C#" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "Machine\Software\Classes\WOW64K" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00002952.00000000.211500.1BC20000.00000004.mdmp2f:T910,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%TEMP%\ntdll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "Dllhost.exe" failed to load missing module "%TEMP%\avicap32.dll" - [base:0; Status:ffffffffc0000135]30:T4818,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "KERNEL32" at base 7fffead10000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fffea060000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "ADVAPI32.DLL" at base 7fffea300000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffb6550000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "SHLWAPI.DLL" at base 7fffea0a0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fffe8460000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "VERSION.DLL" at base 7fffdf0b0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffa5110000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "USER32.DLL" at base 7fffebb00000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "MSCOREE.DLL" at base 7fffb65f0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "NTDLL" at base 7fffebff0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fffeb6e0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "PSAPI.DLL" at base 3060000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "RPCRT4.DLL" at base 7fffeb5c0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "KERNEL32.DLL" at base 7fffead10000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7fffa3b50000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "OLE32.DLL" at base 7fffebe10000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffe6a40000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fffeb6e0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffb1f90000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7fffa2f30000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7fffb1ad0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7fffa1e40000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "WLDP.DLL" at base 7fffe8c00000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "AMSI.DLL" at base 7fffdc230000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fffdf0b0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7fffdba50000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSWOW64\SZ7YE897.DLL" at base 7fffc32a0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7fffcdc30000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fffead10000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fffea300000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7fffa13b0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\46C2F46666E40896049AED7E4ED25573\MICROSOFT.VISUALBASIC.NI.DLL" at base 7fffb17b0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "USER32" at base 7fffebb00000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "SHELL32.DLL" at base 1c020000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fffe3170000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fffd5060000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fffda110000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "SSPICLI.DLL" at base 7fffe86b0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fffe9720000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "VIRTDISK.DLL" at base 7fffb6360000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7fffe7410000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7fffe72d0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7fffcf650000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7fffe25f0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "NTDLL.DLL" at base 7fffebff0000 "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fffe68a0000 "Dllhost.exe" loaded module "KERNEL32" at base 7fffead10000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffe9720000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffe9720000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffe9720000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fffea060000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffe9720000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffe9720000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffe9720000 "Dllhost.exe" loaded module "ADVAPI32.DLL" at base 7fffea300000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffb6550000 "Dllhost.exe" loaded module "SHLWAPI.DLL" at base 7fffea0a0000 "Dllhost.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fffe8460000 "Dllhost.exe" loaded module "VERSION.DLL" at base 7fffdf0b0000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffa5110000 "Dllhost.exe" loaded module "USER32.DLL" at base 7fffebb00000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fffe9720000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "Dllhost.exe" loaded module "MSCOREE.DLL" at base 7fffb65f0000 "Dllhost.exe" loaded module "NTDLL" at base 7fffebff0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fffeb6e0000 "Dllhost.exe" loaded module "PSAPI.DLL" at base 7c0000 "Dllhost.exe" loaded module "RPCRT4.DLL" at base 7fffeb5c0000 "Dllhost.exe" loaded module "KERNEL32.DLL" at base 7fffead10000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7fffa3b50000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "Dllhost.exe" loaded module "OLE32.DLL" at base 7fffebe10000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffe6a40000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "Dllhost.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fffeb6e0000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fffe9720000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffb1f90000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7fffa2f30000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7fffb1ad0000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7fffa1e40000 "Dllhost.exe" loaded module "WLDP.DLL" at base 7fffe8c00000 "Dllhost.exe" loaded module "AMSI.DLL" at base 7fffdc230000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fffdf0b0000 "Dllhost.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7fffdba50000 "Dllhost.exe" loaded module "%WINDIR%\SYSWOW64\SZ7YE897.DLL" at base 7fffc32a0000 "Dllhost.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7fffcdc30000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fffead10000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fffea300000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7fffa13b0000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\46C2F46666E40896049AED7E4ED25573\MICROSOFT.VISUALBASIC.NI.DLL" at base 7fffb17b0000 "Dllhost.exe" loaded module "USER32" at base 7fffebb00000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Dllhost.exe" loaded module "SHELL32.DLL" at base 1b310000 "Dllhost.exe" loaded module "NTDLL.DLL" at base 7fffebff0000 "Dllhost.exe" loaded module "KERNELBASE" at base 7fffe9720000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fffe83d0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fffe9580000 "Dllhost.exe" loaded module "%TEMP%\NTDLL" at base 0 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffb12e0000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7fffa0b00000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Dllhost.exe" loaded module "BCRYPT.DLL" at base 7fffe8cf0000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "Dllhost.exe" loaded module "IMM32.DLL" at base 7fffea060000 "Dllhost.exe" loaded module "COMCTL32.DLL" at base 7fffb4f50000 "Dllhost.exe" loaded module "WS2_32.DLL" at base 7fffe9fd0000 "Dllhost.exe" loaded module "GDI32.DLL" at base 7fffebcb0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fffe88d0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fffe02f0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fffe19e0000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7fffb0660000 "Dllhost.exe" loaded module "SSPICLI.DLL" at base 7fffe86b0000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7fffde6d0000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fffe9720000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fffdc3b0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fffdcfc0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fffdc3e0000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fffe9720000 "Dllhost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fffe9720000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fffdbf50000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "Dllhost.exe" loaded module "OLEAUT32.DLL" at base a10000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "Dllhost.exe" loaded module "%TEMP%\AVICAP32.DLL" at base 0 "Dllhost.exe" loaded module "AVICAP32.DLL" at base 7fffc6fc0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7fffc31f0000 "Dllhost.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base a10000 "Dllhost.exe" loaded module "SXS.DLL" at base 7fffe9190000 "Dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\CUSTOMMARSHALERS\4E262E951071D2394F40FFEEDE049F05\CUSTOMMARSHALERS.NI.DLL" at base 7fffc3130000 "Dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\CUSTOMMARSHALERS\V4.0_4.0.0.0__B03F5F7F11D50A3A\CUSTOMMARSHALERS.DLL" at base 7fffc4870000 "Dllhost.exe" loaded module "OLEAUT32" at base a10000 "Server.exe" loaded module "KERNEL32" at base 7fffead10000 "Server.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffe9720000 "Server.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffe9720000 "Server.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffe9720000 "Server.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fffea060000 "Server.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffe9720000 "Server.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffe9720000 "Server.exe" loaded module "ADVAPI32.DLL" at base 7fffea300000 "Server.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fffe8460000 "Server.exe" loaded module "VERSION.DLL" at base 7fffdf0b0000 "Server.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7fffa3b50000 "Server.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffe6a40000 "Server.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffb1f90000 "Server.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7fffa2f30000 "Server.exe" loaded module "KERNEL32.DLL" at base 7fffead10000 "Server.exe" loaded module "WLDP.DLL" at base 7fffe8c00000 "Server.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\46C2F46666E40896049AED7E4ED25573\MICROSOFT.VISUALBASIC.NI.DLL" at base 7fffb17b0000 "Server.exe" loaded module "USER32.DLL" at base 7fffebb00000 "Server.exe" loaded module "USER32" at base 7fffebb00000 "Server.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffe972000031:Tb6b,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "Dllhost.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}") "Dllhost.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID") "Dllhost.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\PROGID") "Dllhost.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "Dllhost.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TREATAS") "Dllhost.exe" touched "PSTypeInfo" (Path: "HKCU\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "Dllhost.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "Dllhost.exe" touched "PSEnumVariant" (Path: "HKCU\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "Dllhost.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Dllhost.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Dllhost.exe" touched "PointerMoniker" (Path: "HKCU\CLSID\{00000306-0000-0000-C000-000000000046}\TREATAS")32:T94b,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Dllhost.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"33:T100c,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002952-00000C2D-1971943544] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00002952-00000C2A-2299737443] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00002952-00000C2A-2299843277] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002952-00000C2A-2299930094] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00002952-00000C2A-2300145117] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00002952-00000C2A-2300179094] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002952-00000C2A-2300246966] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00002952-00000C2A-2300342279] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00002952-00000C2A-2300399722] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll" [Source: 00000000-00002952-00000C2A-2300440880] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll" [Source: 00000000-00002952-00000C2A-2300507901] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00002952-00000C2A-2300809670] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00002952-00000C2A-2301407285] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002952-00000C2A-2301459295] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00002952-00000C2A-2301579631] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00002952-00000C2A-2301624293] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002952-00000C2A-2302510135] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005204-00000C2A-2308234740] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00005204-00000C2A-2309495317] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00005204-00000C2A-2309667665] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005204-00000C2A-2309880045] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00005204-00000C2A-2310032380] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll" [Source: 00000000-00005204-00000C2A-2310612529] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00005204-00000C2A-2311011334] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00005204-00000C2A-2311188631]34:T8e3,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}\"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}\"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\3E617B7CF7F9D6E1BB8FDD06EF64A6E6AEC20132549884FAFBBD5BB6118C9A7C.EXE"; Key: ""; Value: "")35:T10ff,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "DATA"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "")36:T8e5,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll.aux" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\bee998043eb1e9badecd282a79540a5e\system.windows.forms.ni.dll.aux" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\ce0fd4f5b50baa17e7b80e4ee874ad11\system.ni.dll.aux" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\3c82a5286b5172d5a68c8df2e09c4c40\system.drawing.ni.dll.aux" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.v9921e851#\46c2f46666e40896049aed7e4ed25573\microsoft.visualbasic.ni.dll.aux" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\990501e6199819806f01c8ecac88baac\system.core.ni.dll.aux" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\users\%osuser%\music\desktop.ini" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" reads file "c:\users\%osuser%\downloads\desktop.ini"37:T794,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\imm32.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\CRYPTSP.DLL" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to touch file "C:\Windows\System32\cryptsp.dll"38:T991,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\System32\MsMpLics.dll" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "Dllhost.exe" trying to access non-existent file "C:\Users\BCnZ8Ib\AppData\Local\Temp\CRYPTSP.DLL" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "Dllhost.exe" trying to access non-existent file "C:\Windows\System32\MsMpLics.dll"39:T8b7,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe.config" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\Stub" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.INI" "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" trying to access non-existent file "C:\Users\BCnZ8Ib\AppData\Local\Temp\Dllhost.exe:Zone.Identifier" "Dllhost.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Dllhost.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Dllhost.exe.config" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "Dllhost.exe" trying to access non-existent file "C:\Users\BCnZ8Ib\AppData\Local\Temp\Dllhost.exe.config" "Dllhost.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\Stub" "Dllhost.exe" trying to access non-existent file "C:\Users\BCnZ8Ib\AppData\Local\Temp\Dllhost.INI" "Dllhost.exe" trying to access non-existent file "C:\Users\BCnZ8Ib\AppData\Local\Temp\Dllhost.exe.Local\" "Dllhost.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll.config" "Server.exe" trying to access non-existent file "C:\Users\BCnZ8Ib\AppData\Local\Temp\Server.exe.config" "Server.exe" trying to access non-existent file "C:\Users\BCnZ8Ib\AppData\Local\Temp\Server.INI" "Server.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Server.exe.config"3a:T5c8,Pattern match: "www.upload.ee/image/2298158/koli.swf" Pattern match: "www.upload.ee/image/2971847/scare4.swf" Pattern match: "www.upload.ee/image/2299952/facey.swf" Heuristic match: "kardan35.zapto.org" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.windows.fo" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Heuristic match: "ystem.se" Heuristic match: "system.web.co" Pattern match: "ww.upload.ee/image/2298158/koli.swf" Pattern match: "ww.upload.ee/image/2971847/scare4.swf" Pattern match: "ww.upload.ee/image/2299952/facey.swf" Heuristic match: "stub.my" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"3b:Tc2b,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Stub\* (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter bee998043eb1e9badecd282a79540a5e (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindNextFileW" with parameter 3c82a5286b5172d5a68c8df2e09c4c40 (UID: 00000000-00002952) "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00002952)3c:Tb15,Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1BB50000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1BB50000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1BB50000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1BB50000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1C820000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1C820000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1C820000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002952.00000000.211500.1C820000.00000002.mdmp")3d:T85b,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found reference to API "12000122686,8288,103,,GetAsyncKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "11999876852,8288,103,,GetAsyncKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "11998952316,8288,104,,GetKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "12000176226,8288,104,,GetKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "11999247980,8288,104,,GetKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "11999436222,8288,104,,GetKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "12000023104,8288,104,,GetKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "11999924416,8288,104,,GetKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "11999627506,8288,103,,GetAsyncKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found reference to API "11998324940,8288,104,,GetKeyState,user32.dll,"00:55:04.687",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp")3e:Tbc5,Found string "[Back]" (Indicator: "[Back]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[shift]" (Indicator: "[shift]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[ctrl]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[Ctrl]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[alt]" (Indicator: "[alt]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[alt]" (Indicator: "[Alt]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[pause]" (Indicator: "[pause]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[left]" (Indicator: "[left]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[right]" (Indicator: "[right]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[down]" (Indicator: "[down]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[insert]" (Indicator: "[insert]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[Delete]" (Indicator: "[Delete]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00002952.00000000.211500.03280000.00000004.mdmp")3f:T5b8,Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002952.00000000.211500.011F0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002952.00000000.211500.011F0000.00000004.mdmp, 00000000-00002952.00000000.211500.013D0000.00000004.mdmp, 00000000-00002952.00000000.211500.03130000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002952.00000000.211500.011F0000.00000004.mdmp, 00000000-00002952.00000000.211500.013D0000.00000004.mdmp, 00000000-00002952.00000000.211500.03130000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002952.00000000.211500.011F0000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002952.00000000.211500.011F0000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002952.00000000.211500.011F0000.00000004.mdmp") Found string "s\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp") Found string "s\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002952.00000000.211500.1BC20000.00000004.mdmp")40:T842,"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\DLLHOST.EXE"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Dllhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")41:T59bc,Executable loaded in memory "MZPEL}eh @ @4W H.text `.rsrc@@.reloc@BpH@yITx( *( *s s s s s *0~o *0~o *0~o *0~o *0~o *0,o 9~,,~( o , rp( s zs ~( o (+ lu%-&+%( o &r;p o o ( o s z~( o +**l/tl[0o! *(" *0 (# ($ *0 (% *0 ( *0(& *0 (# ($ *0 (% *0 ( *0(& *0-(+**0*(" *0~) - (+) ~) *(" *0E ! rqp(+ r{prps rprprqp(+ rqp(+ rqp(+ rp(, o- s. s/ rprprqprprp rqp!r5p"rqp#rqp$rp(+ %rp&rp'rp(*(" *2t (5*(&*0 ((~0 (1 ,rp c(2 (+(3 o4 (*&('5%( ( ( rp(5 (5 (5 **GG50 (6 Po7 *0\d(3 dd( , 81,%( ( ( (5 (5 (5 **,,,0so8 o9 o8 o9 (: 3Ro; o; o< o9 o< o9 (: .*o= o= _,*-*-*03 (> ~(? ~,=~o@ +%( ( ( (5 (5 (5 ~oA ^%( ( ( (5 (5 (5 /%( ( ( (5 (5 (5 s/ sB ~ oC ~ oD ~oE 'oF ~oE 'oG ~~~(H oI (6(@&rprp(,(# (# (# rp(J ,&(#r p(K +:rprp(,(# (# (# (L (#r p(K ~rp~r p(M ~r p~r p~(N r p~(N r p ~(N r p~(N (M rp~(('(K (@&p%( ( ( (5 (5 (5 A%( ( ( (5 (5 (5 ,(O ~ *A,>+iu/%/Wf/5!0P(P (*0 hrprYp(Q (# rp(# 1(R , (# (# t3oS +=oT (# (5 rp(R o& ݦoU -u4,u4oV rp zx X E Rrz7 E"u _ _t( 3 (W z ,(5 *A0F00U~oX oY rp~ (Z o[ o\ (%( ( ( (5 (5 (5 *,,((<*0(?(] *0~oX oY rp~ (Z o^ (# (# (# (# (# (# (# o_ (# (# (# <%( ( ( (# (# (# (5 (5 (5 *__<0u rp(` rp(Z ()&(a 5%( ( ( rp(5 (5 (5 *>>50[u,(# (L (b +u9-*t9rp(` r%p(Z (c od (0&*0 1(~((e FFrQp(: 3rQp(@&8=FrYp(: 3rYp(@&8Frcp(: 3 (.8Frop(: 3rp(f &8Frp(: 3rp(f &8Frp(: @GGrp(: 3@+@Grp(: 3 +*Grp(: 30+Grp(: 3 rp(: 3 +g rp(: 3 +R rp(: 3 += rp(: 3 +( rp(: 3 + rp(: 3 (g &8Frp(: 3 j(/&8Frp(: 3 j(/&8xFr5p(: @ 1HHHrAprp(h (# (# (# r[p(i &9 (# (# (# ( (j (L 8Frgp(: 30rspIIrpJJ(2 (3&8Frp(: 3-rspJJrpII(2@(3&8QFrp(: 3"rpJJ(k IIjj(4&8Frp(: 3"rpJJ(k IIjj(4&8Frp(: 3(l &8Fr'p(: 3 p(18Fr;p(: 3 p(18FrQp(: 3r_p(l &8cFrp(: 3rp(l &8CFrp(: 3rp(l &8#Fr_p(: 3 ݾFrep(: 3(rep~((RJJ('(K (@&݆Frkp(: @KKrup(: 3(B&LKryp(: 3d(B&r}p~(~((m rp(,(# (# (# (n (# (# (# (L (@& Krp(: 3 (%ݻ ݶ rp(: .8oo @s/ ~(~((m o4 op oq (D%( ( ( rp~(rp(K (@&rp(@&(5 (5 (5 sr os W%( ( ( rp~(rp(K (@&rp(@&(5 (5 (5 ݌rp(@&rp(K (t (l &rp~(rps. o8 (m (@&4%( ( ( rp~(rpo (m (@&(5 (5 (5 LLrp(: @!(,t o4 _,FMMr'pM~(MM~(M(k M(M (@&Yo4 1ws/ MMM~(MM~(MM~(M(M o4 op oq (D(B&MMr'pM~(MM~(M(k M(M (@&r-p(;(# (# (# (# (# (# (# (# (# (# r1pNN~N(u (# (# (# r5pNN~N(u (# (# (# r9pNNN(u (# (# (# rAp(i &+(> ~ 1(# (# (# rMp(R (# (# (# 1(v (# (# (# (w (# (# (# (x ,(# (# (# rUpNN1N(u Lr]p(: @!(,t !o4 !_,FMMr'pM~(MM~(M(k M(M (@&ro4 1Ms/ $~(~((m o4 #$##op $oq (D!!(B&MMr'pM~(MM~(M(k M(M (@&!r-p(;(# (# (# (# (# (# (# "MMr]pM~(MM~(M"(# (# (# rep(R (# (# (# (L JJ('M(M (@&%Lrkp(: @(y oz '(y oz RR({ '(| s} ))(~ (&)o )o ( (& o & ( '( &( ( ('o /%( --( -..( ./(5 (5 (5 (o (H (H s %%(~ (()%o %o o (o s/ +rkp~((Z JJ(?+op s/ ,%,( o ,oq (9**~(: . *+,oq ,o op ++o +oq (A&+oA ,oA )o %o [Lrsp(: 3tSSrup(: 3 (C,Sryp(: 3(<( Srp(: 3 (<~o (l &( ryp(: .8oo @s/ 1~((Z o4 0100op 1oq (D%( 33( 344( 42rp~(rp(K (@&rp(@&(5 (5 (5 sr os W%( 77( 755( 56rp~(rp(K (@&rp(@&(5 (5 (5 ݱrp(@&rp(Z rp~(rps. o8 (m (@& (> (t rp( &S%( ::( :88( 89rp~(rp9o (m (@&(5 (5 (5 (Crp(: @~-Urp(@&=+== (> ~=`~ `,~~ `,݄NNN;1HHH<~(# (# (# rp;<(i &<9Z;(# (# (# (# (# (# (# ( (j t rp(: @s/ ?~((Z o4 >?>>op ?oq (Dr-p(;(# (# (# (# (# (# (# ~(# (# (# rpNN~N(u ~(# (# (# rpNN~N(u ~(# (# (# rpNN~N(u %( BB( B@@( @A1+rp(: rp(: `,MMrpM~(MM~(MAo M(M (@&/%( EE( ECC( CD(5 (5 (5 (5 (5 (5 *AEWAMW;S)/=W (WGSD/I]0r_p~((Z rprp(,(# (# (# rp(J ,3&(#rp(-(K ('~((K ݘrprp(,(# (# (# (L (#rp(-(K ('~((K F%( ( ( (-('~((K (5 (5 (5 ( ~((K @%( ( ( rp~((K (5 (5 (5 ( ~((K @%( ( ( rp~((K (5 (5 (5 ~o ( rp( ~((K @%( ( ( r#p~((K (5 (5 (5 rp~((K ~o o r5prpo rIprYpo raprpo reprpo ripropo rsprYpo (Z ;%( ( ( rp(Z (5 (5 (5 r}p(Z ( o rop(e 3rp(Z ښ(Z ;%( ( ( rp(Z (5 (5 (5 &( rpo ,rp~((K Nrp~((K ;%( ( ( ~((Z (5 (5 (5 (,rp~((K +rp~((K !!!($!~(!($!~(!($!~(!(M rp~oX oY rp~ (Z o o #"+&#"o4 3rp(K """#2/%( ( ( (5 (5 (5 (Z *dF@Yl@/@,r;=";]9;M`/0 (> ~9&~~(` o9 rp~o9 (K s. (!:~(` rp~(K ( ,~(` rp~(K ( ~(` rp~(K s ~o ( o o o ~(` rp~(K s. ~o (l &( 0%( ( ( ( (5 (5 (5 rprp( /%( ( ( (5 (5 (5 rp~o r+ p~o8 r3 p(M (f &/%( ( ( (5 (5 (5 ~9~oX oY ~"o[ ~ rE p~o rI p(K o /%( ( ( (5 (5 (5 ~oX o ~"o[ ~ rE p~o rI p(K o /%( ( ( (5 (5 (5 ~rqp(+ 3;~o ( rp~rp(m ( %( (5 ~!rqp(: 3[(o o o rS p(Z (o ( ( o rk p(Z (f & '(> %( (5 ~#(+ ,( ( *XK 0:L/{U/ ?H/w?/,"1p0( 9x~rqp(: 3%~( #@@Zl( ( (> ~$rqp(: @(6 ~r pr p( rypr p( r pr p( r pr-p( r pr p( (P o7 (6 ~r pr p( r pr p( r pr-p( r pr p( (P o7 ~oX oY r prypo ,%( ( ( (5 (5 (5 (> ~ s -( (7~-#~o8 ~o; o< =s s (# r p(i &/%( ( ( (5 (5 (5 rp~,Hs ( ( ~ -rp( 3E( ( o /%( ( ( (5 (5 (5 2/((: .r' p~((K (@&~9~oX oY ~"rp~ (K rpo_ (# (# (# rE p~o rI p(K ( ,=~oX oY ~"o[ ~ rE p~o rI p(K o /%( ( ( (5 (5 (5 ~oX o ~"rp~ (K rpo_ (# (# (# rE p~o rI p(K ( ,=~oX o ~"o[ ~ rE p~o rI p(K o /%( ( ( (5 (5 (5 /%( ( ( (5 (5 (5 8A, L,3/>W//,//"/0?s o rp + r/ p( (Z 2*0n( o +T o +6o rp(Z o ,o o o *2 2*0@( o (:&(%( ( ( (5 (5 (5 *(0rp~9j 3(> ~ -~o /~oE o &~o >mj@rp~o o YE+9f( rpj3rp(@&j ~o >J+( ( (H (k (Z 8{~o ֍! ~o ~ j 1 jڷ֍! ~oE ~ ~ o ~~ op ~o @j s s ~oq o do &~oA s/ 8G/%( ( ( (5 (5 (5 ~,0~(# (# (# r5 p(i &/%( ( ( (5 (5 (5 ("-+ 8zA4/9=/0L( s rp rA p +% o4 o oo ( (Z 1 *0 (6 Po *0 (?(A*0 ~ -*~(? ~ - s/ ( rw p(Z (?op op ~oE oq o o &݅,(O w%( ( ( ~ , ~o@ /%( ( ( (5 (5 (5 (5 (5 (5 ~ **({/ w0!~oX oY rp~ (Z o (# (# (# (# (# (# (# o -%( ( ( (5 (5 (5 *RR-0+"( rp~ (K ( (<~oX oY ~"o[ ~ o (%( ( ( (5 (5 (5 ~oX o ~"o[ ~ o ,%( ( ( (5 (5 (5 r{ p~o rE p(K (f &/%( ( ( (5 (5 (5 ~,)~oA ( rp~ rp(m ( /%( ( ( (5 (5 (5 ~oX oY r po[ ~ o /%( ( ( (5 (5 (5 r p~o rE p(K (f &/%( ( ( (5 (5 (5 ( *L&'M(u',$/2M/|'/$/0q#s s !o jo o &( jo ֍! o & oA oA *03$~)( , rp ( o s )~)*0%~****VsI( t +*( *0&~+*0&(J*(N,rp-./*(" *0.'ds (Qd(S&rw p( o *0(o o *0~-*0R.Vs s 0~0o /Ws s 1~1o (8*0(8d(> ~,(N(: (Nrp(: _,{(N,(o o ~-r9p( rAp( rSp( r[p(Nrcp(M (Z -~.:E*0)8j(P Aj(P(O___(O___`,~-r-p(Z -(O___(O___`,~-rkp(Z -Bj(P(O___(O___`,~-rop(Z -(O___(O___`,~-rsp(Z -Cj(P(O___(O___`,~-rwp(Z -(O___(O___`,~-rp(Z -Dj(P(O___(O___`,~-r{p(Z -(O___(O___`,~-rp(Z -Ej(P(O___(O___`,~-rp(Z -(O___(O___`,~-r p(Z -Fj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Gj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Hj(P(O___(O___`,~-rp(Z -(O___(O___`,~-r1p(Z -Ij(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Jj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Kj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Lj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Mj(P(O___(O___`,~-r p(Z -(O___(O___`,~-rp(Z -Nj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Oj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Pj(P(O___(O___`,~-rp(Z -(O___(O___`,~-r5p(Z -Qj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Rj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Sj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Tj(P(O___(O___`,~-r p(Z -(O___(O___`,~-rp(Z -Uj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Vj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Wj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Xj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Yj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Zj(P(O___(O___`,~-r p(Z -(O___(O___`,~-rp(Z -1j(P__,~-rp(Z -__,~-ryp(Z -2j(P__,~-rp(Z -__,~-rp(Z -3j(P__,~-rp(Z -__,~-rp(Z -4j(P__,~-rp(Z -__,~-rp(Z -5j(P__,~-rp(Z -__,~-rp(Z -6j(P__,~-rp(Z -__,~-rp(Z -7j(P__,~-r#p(Z -__,~-r'p(Z -8j(P__,~-r+p(Z -__,~-r/p(Z -9j(P__,~-r3p(Z -__,~-r7p(Z -0j(P__,~-rp(Z -__,~-r;p(Z -j(P_3~-r?p(Z - j(P_3~-rMp(Z - j(P_3~-r p(Z -j(P_3~-rYp(Z -j(P_3~-rip(Z -j(P_3~-rwp(Z -j(P_3~-rp(Z -j(P_3~-rp(Z - j(P_3~-rop(Z -#j(P_3~-rp(Z -$j(P_3~-rp(Z -%j(P_3~-rp(Z -'j(P_3~-rp(Z -&j(P_3~-rp(Z -(j(P_3~-rp(Z --j(P_3~-rp(Z -.j(P_3~-r p(Z - j(P__,~-r p(Z -__,~-rp(Z - j(P__,~-r p(Z -__,~-r p(Z - j(P__,~-rp(Z -__,~-r p(Z - j(P__,~-r p(Z -__,~-rp(Z - j(P__,~-rp(Z -__,~-r# p(Z - j(P__,~-r' p(Z -__,~-r+ p(Z - j(P__,~-r/ p(Z -__,~-rup(Z - j(P__,~-rp(Z -__,~-rp(Z - j(P__,~-rp(Z -__,~-r3 p(Z - j(P__,~-rp(Z -__,~-rp(Z - j(P__,~-r7 p(Z -__,~-rE p(Z -jj(P_3~-r/p(Z -oj(P_3~-r' p(Z -kj(P_3~-r p(Z -mj(P_3~-r p(Z -nj(P_3~-rp(Z -pj(P_3~-r; p(Z -qj(P_3~-rE p(Z -rj(P_3~-rO p(Z -sj(P_3~-rY p(Z -tj(P_3~-rc p(Z -uj(P_3~-rm p(Z -vj(P_3~-rw p(Z -wj(P_3~-r p(Z -xj(P_3~-r p(Z -yj(P_3~-r p(Z -zj(P_3~-r p(Z -{j(P__,~-r p(Z -__,(U& j(P_3~-r p(Z - j(P_3~-r p(Z -*j(P_3~-r p(Z -!j(P_3~-rp(Z -"j(P_3~-rp(Z -aj(P_3~-rp(Z -bj(P_3~-rp(Z -cj(P_3~-rp(Z -dj(P_3~-rp(Z -ej(P_3~-rp(Z -fj(P_3~-rp(Z -gj(P_3~-r#p(Z -hj(P_3~-r+p(Z -ij(P_3~-r3p(Z -`j(P_3~-rp(Z -j(P_3~-r+p(Z -~/:*lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPBSJBv4.0.30319t#~#Strings/<#US(>#GUID8>#Blob W= 31WQP) 6L6ax C @ " :RC. C!C?C FR^C|C RC6,; ;#t~/C 4RJC t R9 ~ C C R 6 C b ~ TgJv . . JJJJ 3?.O.}.2WJj.~J.CC 7iCC)C q .C-V~~C~ *C 1]CiC*KW C 5 I.;:N];}#y BE)E+H=,KfE,L1J1R1+ZEb1]jBVOV^mor #'*-v ;{ hmqv{ P X ` { !"@"H"Fj^d"Fsx""F"Fj^"Fs""F##8#@#h#p#{$$q$$ %,/ %1C 5G&k& Ch* *U , P, , [ _ q y ,D!d-c#-# $ % ) ' - W / 6`.H:|B;GH;KH;QU; !d t v x { ~ m/ *=mVVm /! $ !&)1$,$,IQYiySWa3^Lcaaxjp{a9[9j^9s9<@Sd)))19#9")I^eAAeQYa . i@ iP c m Iu Y q y! #y- SB 'q 6 < B H q U ;L_m1-!J\ir1 I 9I)I@0A5A;'A >J'S HYYqgmiwY} S q1qy%y.DS [y",99P]9aeCnL<9]tb{9 1SQ:L1U)1gIy ]8b@mGvMS1_i}a1)i9QQQ"I8AAB9J QiXC 5 5 K aQ [ ` qh a` 9l My ( 1 ) SQ Q+ ;U ]l !) $).s..... ...#.S.|..@@+ECC,Ic,ci +EE,E+E;.+EE;++ECEES +E +E#CE# #SE#E#E@+ECCEC" C I| ``+EcEcCEcSEcE+E +E @+E@`+E`+E+E+E+E+E ERR+R-R7R=ROR[R]RmRoRRF6Ts-~1 &c ; @) 5 ] EGFJKY`jsyryPCA5CQ CSCUCW&C_FaFc CeK CgW Ci uCC CC .C J~~~)~+~7v7Stub.exeStubmscorlibMicrosoft.VisualBasicSystem.Windows.FormsSystemSystem.Drawinguser32winmm.dllkernel32ntdlluser32.dllavicap32.dllKernel32.dllStub.Resources.resourcesMyApplicationStub.MyConsoleApplicationBaseMicrosoft.VisualBasic.ApplicationServices.ctorEditorBrowsableAttributeSystem.ComponentModelEditorBrowsableStateGeneratedCodeAttributeSystem.CodeDom.CompilerMyComputerComputerMicrosoft.VisualBasic.DevicesDebuggerHiddenAttributeSystem.DiagnosticsMyProjectObjectm_ComputerObjectProviderm_AppObjectProviderm_UserObjectProviderUserm_MyFormsObjectProviderm_MyWebServicesObjectProvider.cctorget_GetInstanceget_Computerget_Applicationget_Userget_Formsget_WebServicesHelpKeywordAttributeSystem.ComponentModel.DesignApplicationFormsWebServicesHideModuleNameAttributeStandardModuleAttributeMicrosoft.VisualBasic.CompilerServicesMyFormsm_FormBeingCreatedHashtableSystem.CollectionsThreadStaticAttributeTargetInvocationExceptionSystem.ReflectionControlget_IsDisposedTypeGetTypeFromHandleRuntimeTypeHandleContainsKeyStringUtilsGetResourceStringInvalidOperationExceptionAddActivatorCreateInstanceProjectDataSetProjectErrorExceptionget_InnerExceptionget_MessageRemoveCreate__Instance__InstanceComponentDisposeDispose__Instance__instanceRuntimeHelpersSystem.Runtime.CompilerServicesGetObjectValueEqualsoGetHashCodeGetTypeToStringMyGroupCollectionAttributeMyWebServicesThreadSafeObjectProvider`1m_ThreadStaticValueCompilerGeneratedAttributeGetInstanceComVisibleAttributeSystem.Runtime.InteropServicesOKStub.OK.jSWP_HIDEWINDOWSWP_SHOWWINDOWbBDCTcpClientSystem.Net.SocketsCnDREXEFFSFileStreamSystem.IOHicnIdrIsFRegistryStlastcapLOFileInfoMeMMemoryStreamMTPxDlol1SleepSleep1PLGRGTasksfHideHPSPRVNVRYByteConversionsToBooleanAssemblyGetEntryAssemblyget_LocationHassanAmiria0ImHereSessionEndingEventArgsMicrosoft.Win32a1IntPtrZeroop_Equalityop_ExplicitStringsSpaceget_LengthClearProjectErrorACTEncodingSystem.Textget_UTF8GetStringBSBCamcapGetDriverDescriptionAwDriverlpszNamecbNamelpszVercbVerDirectoryInfoget_NameToLowerOperatorsCompareStringget_Directoryget_ParentCompDirF1F2ThreadSystem.ThreadingMonitorEnterCloseStreamset_ReceiveBufferSizeset_SendBufferSizeget_ClientSocketset_SendTimeoutset_ReceiveTimeoutToIntegerConnectConditionalCompareObjectEqualConcatExitconnectConvertFromBase64StringDEBsIEnumeratorInteractionGetObjectBooleanNewLateBindingLateGetIEnumerableGetEnumeratorget_CurrentMoveNextIDisposableCreateProjectErrorGetAntiVirusServerComputerget_RegistryRegistryProxyMicrosoft.VisualBasic.MyServicesget_CurrentUserRegistryKeyOpenSubKeyDeleteValueDLVnEDToBase64StringENBGetForegroundWindowGetVolumeInformationlpRootPathNamelpVolumeNameBuffernVolumeNameSizelpVolumeSerialNumberlpMaximumComponentLengthlpFileSystemFlagslpFileSystemNameBuffernFileSystemNameSizeGetVolumeInformationAGetWindowTexthWndWinTitleMaxLengthGetWindowTextAGetWindowTextLengthhwndGetWindowTextLengthAGetValueGTVretEnvironConversionHexHWDImageFromFileImageFormatSystem.Drawing.Imagingget_BmpSaveSetWallpaperWallpaperSwapMouseButtonbSwapSystemParametersInfouActionuParamlpvParamfuWinIniSendMessagemsgwParamlparamFindWindowlpClassNamelpWindowNameFindWindowASetWindowPoshWndInsertAfterxycxcywFlagsmciSendStringCommandReturnStringReturnLengthmciSendStringAWebClientSystem.NetMessageBoxIconMessageBoxButtonsBitmapSizeRectangleGraphicsSplitCompareMethodShellAppWinStyleMessageBoxShowDialogResultCreateObjectLateCallChangeTypeProcessStartConcatenateObjectget_CharsWriteToArrayDownloadDataFileWriteAllBytesLateSetCompareObjectEqualOrObjectScreenget_PrimaryScreenget_Boundsget_Widthget_HeightPixelFormatFromImageCopyFromScreenCopyPixelOperationCursorget_PositionPointCursorsget_DefaultDrawDrawImageget_JpegWriteByteEndAppFileSystemInfoget_FullNameIndDateTimeEnvironmentget_MachineNameget_UserNameget_LastWriteTimeget_Dateget_InfoComputerInfoget_OSFullNameReplaceget_OSVersionOperatingSystemget_ServicePackGetFolderPathSpecialFolderContainsCreateSubKeyRegistryKeyPermissionCheckGetValueNamesinfExistsDeleteFileModeReadAllBytesFlushSetEnvironmentVariableEnvironmentVariableTargetSetValueget_LocalMachineCopyget_FileSystemFileSystemProxyget_SpecialDirectoriesSpecialDirectoriesProxyget_Tempget_ExecutablePathSetAttributesFileAttributesINSToDoubleMathRoundMutexThreadStartSessionEndingEventHandlerSystemEventsadd_SessionEndingDoEventsGetCurrentProcessset_MinWorkingSetConditionalCompareObjectNotEqualkoMD5CryptoServiceProviderSystem.Security.CryptographyHashAlgorithmComputeHashmd5NtSetInformationProcesshProcessprocessInformationClassprocessInformationprocessInformationLengthModuleLoadGetModulesGetTypesEndsWithget_AssemblyPlugincget_Handlepriget_AvailablePollSelectModeGetStreamNetworkStreamReadByteToLongChrWCharReceiveSocketFlagsParameterizedThreadStartJoinRCRandomVBMathRandomizeNextRNGetBytesSBSSendInt32SendbRegistryValueKindSTVttypDeleteSubKeyUNSGZipStreamSystem.IO.CompressionCompressionModeset_PositionReadBitConverterToInt32ZIPResourcesStub.My.ResourcesresourceManResourceManagerSystem.ResourcesresourceCultureCultureInfoSystem.GlobalizationReferenceEqualsget_ResourceManagerget_Cultureset_CultureValueCultureDebuggerNonUserCodeAttributeMySettingsApplicationSettingsBaseSystem.ConfigurationdefaultInstanceSettingsBaseSynchronizedDefaultMySettingsPropertyget_SettingsSettingsAactvBRKrunxrunythxthyInStrSubstringACTvvget_KeyboardKeyboardget_CapsLockCPOMGetAsyncKeyStatevKeyGetLlpStringcchmainSTAThreadAttributeRegisterServiceProcessdwProcessIddwTypeget_ClockClockget_LocalTimeDateAndTimeget_Nowget_TimeStringtimx_runtimy_runTFormAssemblyCompanyAttributeAssemblyTitleAttributeAssemblyProductAttributeRuntimeCompatibilityAttributeTargetFrameworkAttributeSystem.Runtime.VersioningAssemblyCopyrightAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeAssemblyDescriptionAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttribute9WinForms_RecursiveFormCreate5WinForms_SeeInnerException True TEMPDllhost.exe=a2Fy, @ * @ GFu5 ? ( @ zUuemFwdG8ub3Jn#ic|$ > k4Nw==Java update17Windows Update[Software\Microsoft\Windows\CurrentVersion\RunfalsedGVzdDM=ANjrat 0.7 Golden By Hassan Amiri|Hassan|vn :inf=Select * From AntiVirusProductCwinmgmts:\\.\root\SecurityCenter2ExecQuerydisplayNameNo AntivirusSoftware\SystemDrive\ERR temp+\CurrentWallpaper.Bmpfun sitecwallRestart#shutdown -r -t 00Shutdown#shutdown -s -t 00ErorrMsg123456NormalMouseReverseMousepeechSAPI.SpvoicespeakHideMShell_traywndShowM opencd+set cdaudio door openclosecd/set cdaudio door closedOpenPageMonitorONMonitorOFF Scary1Iwww.upload.ee/image/2298158/koli.swf Scary2Mwww.upload.ee/image/2971847/scare4.swf Scary3Kwww.upload.ee/image/2299952/facey.swfllkl prof~!getvalue@rnMSGExecute ERRORblaDownload ERROR.Executed As Execute ERROR invplAhposkstartOffoffretGTCAPunupUpdate ERROR .exeUpdating To ..Update ERROR ExPLGindHPcER_??yy-MM-dd??-??-??MicrosoftWindowsWin"! WinSP0x86 x64 x86YesNo,+SEE_MASK_NOZONECHECKSIHassan firewall add allowedprogram "" "" ENABLE" " ../Server.execschtasks /create /sc minute /mo 1 /tn Server /tr 5 ? ( @ M=T. G , @ * @ Z|$ > XĳediStartactx2clear5abcdefghijklmnopqrstuvwxyzOHassan firewall delete allowedprogram "Software=cmd.exe /c ping 0 -n 2 & del "Stub.Resources yy/MM/dd | - aBbCDdEFfGgIiJjKkLlmNnOoQqRrSstUuVvWwXxYyz#$%^7&8*9() [Back][tab][shift] [ctrl][alt][pause][esc][end] [home] [left][right] [up] [down][insert][Delete];+<->/?`|' [F1] [F2] [F3] [F4] [F5] [F6] [F7] [F8] [F9][F10][F11][F12][NumLock][ScrollLock][PrintScreen][PageUp][Pagedown] [Ctrl]z\V4?_ : MyTemplate10.0.0.0!! !! My.ComputerMy.Application!My.User My.FormsMy.WebServices1 9 AE ] ] ] 0 A A XSystem.Windows.Forms.FormCreate__Instance__Dispose__Instance__My.MyProject.Formsa4System.Web.Services.Protocols.SoapHttpClientProtocolCreate__Instance__Dispose__Instance__ ( @uy}]]] ]]] " }},}]]]]]]]]]]]]]]]} AA ]]]] ]]] ]]] T]]]]]]]]]]]]]]]]]]]]]]]]]]] AAA AA! % )1 1- E$]]]]]]]]]]]]]]]]]]]]]]]]== = E IM Q +y]]]]]]]]]]]]]]]]] UY ] a i2]]]]]]]]]]]]]]]]]]]]] uy AA A ]]]]]] }]]]]]]} ]]] &]]]]]]]]]]]]]]]]]] @3System.Resources.Tools.StronglyTypedResourceBuilder4.0.0.0((((YKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator10.0.0.0My.Settings u == =TWrapNonExceptionThrowse).NETFramework Version=v4.0 Profile=ClientTFrameworkDisplayName.NET Framework 4 Client Profile 1.0.0.0)$68c310d8-2cc8-417a-b3db-f782bc869a2b\~ p_CorExeMainmscoree.dll% @3", Executable loaded in memory "MZPEL}eh @ @4W H.text `.rsrc@@.reloc@BpH@yITx( *( *s s s s s *0~o *0~o *0~o *0~o *0~o *0,o 9~,,~( o , rp( s zs ~( o (+ lu%-&+%( o &r;p o o ( o s z~( o +**l/tl[0o! *(" *0 (# ($ *0 (% *0 ( *0(& *0 (# ($ *0 (% *0 ( *0(& *0-(+**0*(" *0~) - (+) ~) *(" *0E ! rqp(+ r{prps rprprqp(+ rqp(+ rqp(+ rp(, o- s. s/ rprprqprprp rqp!r5p"rqp#rqp$rp(+ %rp&rp'rp(*(" *2t (5*(&*0 ((~0 (1 ,rp c(2 (+(3 o4 (*&('5%( ( ( rp(5 (5 (5 **GG50 (6 Po7 *0\d(3 dd( , 81,%( ( ( (5 (5 (5 (i &/%( ( ( (5 (5 (5 rp~,Hs ( ( ~ -rp( 3E( ( o /%( ( ( (5 (5 (5 2/((: .r' p~((K (@&~9~oX oY ~"rp~ (K rpo_ (# (# (# rE p~o rI p(K ( ,=~oX oY ~"o[ ~ rE p~o rI p(K o /%( ( ( (5 (5 (5 ~oX o ~"rp~ (K rpo_ (# (# (# rE p~o rI p(K ( ,=~oX o ~"o[ ~ rE p~o rI p(K o /%( ( ( (5 (5 (5 /%( ( ( (5 (5 (5 8A, L,3/>W//,//"/0?s o rp + r/ p( (Z 2*0n( o +T o +6o rp(Z o ,o o o *2 2*0@( o (:&(%( ( ( (5 (5 (5 *(0rp~9j 3(> ~ -~o /~oE o &~o >mj@rp~o o YE+9f( rpj3rp(@&j ~o >J+( ( (H (k (Z 8{~o ֍! ~o ~ j 1 jڷ֍! ~oE ~ ~ o ~~ op ~o @j s s ~oq o do &~oA s/ 8G/%( ( ( (5 (5 (5 ~,0~(# (# (# r5 p(i &/%( ( ( (5 (5 (5 ("-+ 8zA4/9=/0L( s rp rA p +% o4 o oo ( (Z 1 *0 (6 Po *0 (?(A*0 ~ -*~(? ~ - s/ ( rw p(Z (?op op ~oE oq o o &݅,(O w%( ( ( ~ , ~o@ /%( ( ( (5 (5 (5 (5 (5 (5 ~ **({/ w0!~oX oY rp~ (Z o (# (# (# (# (# (# (# o -%( ( ( (5 (5 (5 *RR-0+"( rp~ (K ( (<~oX oY ~"o[ ~ o (%( ( ( (5 (5 (5 ~oX o ~"o[ ~ o ,%( ( ( (5 (5 (5 r{ p~o rE p(K (f &/%( ( ( (5 (5 (5 ~,)~oA ( rp~ rp(m ( /%( ( ( (5 (5 (5 ~oX oY r po[ ~ o /%( ( ( (5 (5 (5 r p~o rE p(K (f &/%( ( ( (5 (5 (5 ( *L&'M(u',$/2M/|'/$/0q#s s !o jo o &( jo ֍! o & oA oA *03$~)( , rp ( o s )~)*0%~****VsI( t +*( *0&~+*0&(J*(N,rp-./*(" *0.'ds (Qd(S&rw p( o *0(o o *0~-*0R.Vs s 0~0o /Ws s 1~1o (8*0(8d(> ~,(N(: (Nrp(: _,{(N,(o o ~-r9p( rAp( rSp( r[p(Nrcp(M (Z -~.:E*0)8j(P Aj(P(O___(O___`,~-r-p(Z -(O___(O___`,~-rkp(Z -Bj(P(O___(O___`,~-rop(Z -(O___(O___`,~-rsp(Z -Cj(P(O___(O___`,~-rwp(Z -(O___(O___`,~-rp(Z -Dj(P(O___(O___`,~-r{p(Z -(O___(O___`,~-rp(Z -Ej(P(O___(O___`,~-rp(Z -(O___(O___`,~-r p(Z -Fj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Gj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Hj(P(O___(O___`,~-rp(Z -(O___(O___`,~-r1p(Z -Ij(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Jj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Kj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Lj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Mj(P(O___(O___`,~-r p(Z -(O___(O___`,~-rp(Z -Nj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Oj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Pj(P(O___(O___`,~-rp(Z -(O___(O___`,~-r5p(Z -Qj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Rj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Sj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Tj(P(O___(O___`,~-r p(Z -(O___(O___`,~-rp(Z -Uj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Vj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Wj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Xj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Yj(P(O___(O___`,~-rp(Z -(O___(O___`,~-rp(Z -Zj(P(O___(O___`,~-r p(Z -(O___(O___`,~-rp(Z -1j(P__,~-rp(Z -__,~-ryp(Z -2j(P__,~-rp(Z -__,~-rp(Z -3j(P__,~-rp(Z -__,~-rp(Z -4j(P__,~-rp(Z -__,~-rp(Z -5j(P__,~-rp(Z -__,~-rp(Z -6j(P__,~-rp(Z -__,~-rp(Z -7j(P__,~-r#p(Z -__,~-r'p(Z -8j(P__,~-r+p(Z -__,~-r/p(Z -9j(P__,~-r3p(Z -__,~-r7p(Z -0j(P__,~-rp(Z -__,~-r;p(Z -j(P_3~-r?p(Z - j(P_3~-rMp(Z - j(P_3~-r p(Z -j(P_3~-rYp(Z -j(P_3~-rip(Z -j(P_3~-rwp(Z -j(P_3~-rp(Z -j(P_3~-rp(Z - j(P_3~-rop(Z -#j(P_3~-rp(Z -$j(P_3~-rp(Z -%j(P_3~-rp(Z -'j(P_3~-rp(Z -&j(P_3~-rp(Z -(j(P_3~-rp(Z --j(P_3~-rp(Z -.j(P_3~-r p(Z - j(P__,~-r p(Z -__,~-rp(Z - j(P__,~-r p(Z -__,~-r p(Z - j(P__,~-rp(Z -__,~-r p(Z - j(P__,~-r p(Z -__,~-rp(Z - j(P__,~-rp(Z -__,~-r# p(Z - j(P__,~-r' p(Z -__,~-r+ p(Z - j(P__,~-r/ p(Z -__,~-rup(Z - j(P__,~-rp(Z -__,~-rp(Z - j(P__,~-rp(Z -__,~-r3 p(Z - j(P__,~-rp(Z -__,~-rp(Z - j(P__,~-r7 p(Z -__,~-rE p(Z -jj(P_3~-r/p(Z -oj(P_3~-r' p(Z -kj(P_3~-r p(Z -mj(P_3~-r p(Z -nj(P_3~-rp(Z -pj(P_3~-r; p(Z -qj(P_3~-rE p(Z -rj(P_3~-rO p(Z -sj(P_3~-rY p(Z -tj(P_3~-rc p(Z -uj(P_3~-rm p(Z -vj(P_3~-rw p(Z -wj(P_3~-r p(Z -xj(P_3~-r p(Z -yj(P_3~-r p(Z -zj(P_3~-r p(Z -{j(P__,~-r p(Z -__,(U& j(P_3~-r p(Z - j(P_3~-r p(Z -*j(P_3~-r p(Z -!j(P_3~-rp(Z -"j(P_3~-rp(Z -aj(P_3~-rp(Z -bj(P_3~-rp(Z -cj(P_3~-rp(Z -dj(P_3~-rp(Z -ej(P_3~-rp(Z -fj(P_3~-rp(Z -gj(P_3~-r#p(Z -hj(P_3~-r+p(Z -ij(P_3~-r3p(Z -`j(P_3~-rp(Z -j(P_3~-r+p(Z -~/:*lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPBSJBv4.0.30319t#~#Strings/<#US(>#GUID8>#Blob W= 31WQP) 6L6ax C @ " :RC. C!C?C FR^C|C RC6,; ;#t~/C 4RJC t R9 ~ C C R 6 C b ~ TgJv . . JJJJ 3?.O.}.2WJj.~J.CC 7iCC)C q .C-V~~C~ *C 1]CiC*KW C 5 I.;:N];}#y BE)E+H=,KfE,L1J1R1+ZEb1]jBVOV^mor #'*-v ;{ hmqv{ P X ` { !"@"H"Fj^d"Fsx""F"Fj^"Fs""F##8#@#h#p#{$$q$$ %,/ %1C 5G&k& Ch* *U , P, , [ _ q y ,D!d-c#-# $ % ) ' - W / 6`.H:|B;GH;KH;QU; !d t v x { ~ m/ *=mVVm /! $ !&)1$"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790902191689,"unified_at":"2026-10-02T00:49:51.689Z","metadata":{"hashes":{"sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","sha1":"a4a2cff87fbf567768eecb1ce3a3c939937be136","md5":"dcfb0a3b24c3c469c4c205ddf2ccd3af","sha512":"b089411899c9160dc9d1e4b0a221dd93f5b00fa78b2b6b84e8771eb3fb68ec36c970716cff14d6e8a4d21803394119c6424b893168be409eed6b800643a263fa","ssdeep":"384:sv3ZIvmA2jReogaUPZCGJsdDVcp0F9h2HbmdPvo8I6CQsJfIFgjEZhmHG:svpvA2jkDc/d6pwgwvj1CDgFjhmm","ssdeep_chunks":["384:sv3ZIvm","384:v3ZIvmA","384:3ZIvmA2","384:ZIvmA2j","384:IvmA2jR","384:vmA2jRe","384:mA2jReo","384:A2jReog","384:2jReoga","384:jReogaU","384:ReogaUP","384:eogaUPZ","384:ogaUPZC","384:gaUPZCG","384:aUPZCGJ","384:UPZCGJs","384:PZCGJsd","384:ZCGJsdD","384:CGJsdDV","384:GJsdDVc","384:JsdDVcp","384:sdDVcp0","384:dDVcp0F","384:DVcp0F9","384:Vcp0F9h","384:cp0F9h2","384:p0F9h2H","384:0F9h2Hb","384:F9h2Hbm","384:9h2Hbmd","384:h2HbmdP","384:2HbmdPv","384:HbmdPvo","384:bmdPvo8","384:mdPvo8I","384:dPvo8I6","384:Pvo8I6C","384:vo8I6CQ","384:o8I6CQs","384:8I6CQsJ","384:I6CQsJf","384:6CQsJfI","384:CQsJfIF","384:QsJfIFg","384:sJfIFgj","384:JfIFgjE","384:fIFgjEZ","384:IFgjEZh","384:FgjEZhm","384:gjEZhmH","384:jEZhmHG","768:sv3ZIvm","768:v3ZIvmA","768:3ZIvmA2","768:ZIvmA2j","768:IvmA2jR","768:vmA2jRe","768:mA2jReo","768:A2jReog","768:2jReoga","768:jReogaU","768:ReogaUP","768:eogaUPZ","768:ogaUPZC","768:gaUPZCG","768:aUPZCGJ","768:UPZCGJs","768:PZCGJsd","768:ZCGJsdD","768:CGJsdDV","768:GJsdDVc","768:JsdDVcp","768:sdDVcp0","768:dDVcp0F","768:DVcp0F9","768:Vcp0F9h","768:cp0F9h2","768:p0F9h2H","768:0F9h2Hb","768:F9h2Hbm","768:9h2Hbmd","768:h2HbmdP","768:2HbmdPv","768:HbmdPvo","768:bmdPvo8","768:mdPvo8I","768:dPvo8I6","768:Pvo8I6C","768:vo8I6CQ","768:o8I6CQs","768:8I6CQsJ","768:I6CQsJf","768:6CQsJfI","768:CQsJfIF","768:QsJfIFg","768:sJfIFgj","768:JfIFgjE","768:fIFgjEZ","768:IFgjEZh","768:FgjEZhm","768:gjEZhmH","768:jEZhmHG","384:svpvA2j","384:vpvA2jk","384:pvA2jkD","384:vA2jkDc","384:A2jkDc/","384:2jkDc/d","384:jkDc/d6","384:kDc/d6p","384:Dc/d6pw","384:c/d6pwg","384:/d6pwgw","384:d6pwgwv","384:6pwgwvj","384:pwgwvj1","384:wgwvj1C","384:gwvj1CD","384:wvj1CDg","384:vj1CDgF","384:j1CDgFj","384:1CDgFjh","384:CDgFjhm","384:DgFjhmm"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec2013254988.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":25948,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1751487638000,"last_seen":1751492219000,"last_multi_scan":1751492219000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","njrat","rat","evasive"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":64},"sandbox_signatures":{"informative_count":116,"suspicious_count":10,"malicious_count":12,"total":138},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Malware.SLcbg.D0C7FDDC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.njRAT-9886440-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Malware.SLcbg.D0C7FDDC (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Bladabindi.BB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Bladabindi.sm!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FUTJ!A824EEFA1D79","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Bladabindi.BO.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Buts.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_39.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware.SLcbg.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"malicious","value":"Contains ability to capture the screen"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Detected Suricata Alert - CnC Activity"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002952)\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002952)\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002952)\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"LoadResource with parameter {'hModule': '50921473', 'hResInfo': '50929888'}\" (UID: 00000000-00002952)\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"LoadResource with parameter {'hModule': '50921473', 'hResInfo': '50929920'}\" (UID: 00000000-00002952)\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"LoadResource with parameter {'hModule': '50921473', 'hResInfo': '50929936'}\" (UID: 00000000-00002952)\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"LoadResource with parameter {'hModule': '50921473', 'hResInfo': '50929904'}\" (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002952-00000BC0-2300173410\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002952.00000000.211500.011F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\"\n Observed function \"System.Reflection.Load\" in \"Dllhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00002952.00000000.211500.011F0000.00000004.mdmp\")\n Found string - inmgmts:\\\\.\\root\\SecurityCenter2; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.171457161198326","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contacts server\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Detected Suricata Alert - CnC Activity","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005204-00000C2B-2309765972\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005204-00000C2B-2310276773\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00002952.00000000.211500.1BB50000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00002952.00000000.211500.1C820000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002952)\n \"Dllhost.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005204)\n \"Server.exe\" called \"GetTickCount\" (UID: 00000000-00009496)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"EnumWindows\" with parameter \"14667440\" - (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002952)\n \"Dllhost.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005204)\n \"Server.exe\" called \"LookupAccountSidW\" (UID: 00000000-00009496)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; File: \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Dllhost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Dllhost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Server.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set cdaudio door open\" (Indicator: \"set \"; File: \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\")\n Found string \"set cdaudio door closed\" (Indicator: \"set \"; File: \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"Dllhost.exe\" issued a query \"Select * From AntiVirusProduct\"\n \"Dllhost.exe\" issued a query \"$objects\"\n \"Dllhost.exe\" issued a query \"select * from Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" queries volume information of \"C:\\3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" at 00000000-00002952-00000C17-2300178170\n \"Dllhost.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Dllhost.exe\" at 00000000-00005204-00000C17-2305635331\n \"Dllhost.exe\" queries volume information of \"C:\\\" at 00000000-00005204-00000C17-2310950990\n \"Dllhost.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll\" at 00000000-00005204-00000C17-2313150619","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"Dllhost.exe\" queries volume information of \"C:\\\" at 00000000-00005204-00000C17-2310950990","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Dllhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Dllhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DLLHOST.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format\" (SID: 2055385, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002952)\n \"Dllhost.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005204)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"Dllhost.exe\" called \"CopyFileW\" to copy %TEMP%\\Dllhost.exe to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Java update.exe (UID: 00000000-00005204)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\Dllhost.exe\"\" - (UID: 00000000-00002952)\n \"Dllhost.exe\" called \"CreateProcessW\" with parameter \"Hassan firewall add allowedprogram \"%TEMP%\\Dllhost.exe\" \"Dllhost.exe\" ENABLE\" - (UID: 00000000-00005204)\n \"Dllhost.exe\" called \"CreateProcessW\" with parameter \"schtasks /create /sc minute /mo 1 /tn Server /tr %TEMP%\\Server.exe\" - (UID: 00000000-00005204)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"82.147.84.124:1987\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * From AntiVirusProduct\" (Source: 6000024-OK~GetAntiVirus, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002952.00000000.211500.011F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c ping 0 -n 2 & del \\\"\" (Indicator: \"cmd.exe /c\"; File: \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Java update.exe\" (Indicator: \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\java update.exe\") in Source: 00000000-00005204-00000C3C-12038690892","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2952:304:WilStaging_02\"\n \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Windows Update\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:2952:120:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2952:120:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults\"\n \"Local\\SM0:2952:304:WilStaging_02\"\n \"Windows Update\"\n \"Local\\SM0:2952:120:WilError_03\"\n \"SM0:2952:120:WilError_03\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5204:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:5204:120:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5204:120:WilError_03\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Dllhost.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at A3B50000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at A3B50000\n \"Server.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at A3B50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DC230000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DC230000\n \"Server.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DC230000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E9580000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E9580000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E8CF0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E9580000\n \"Server.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E9580000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at A5110000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at A5110000\n \"Server.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at A5110000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EB5C0000\n \"Dllhost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EB5C0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EB5C0000\n \"Server.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EB5C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a0000000000204299e9ff7f0000@ntdll.dll\"\n \"2200230000000000404299e9ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" was detected as \"MPRESS\" and name: \"Packer\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" was detected as \".NET\" and name: \"Library\"\n \"Dllhost.exe\" was detected as \"MPRESS\" and name: \"Packer\"\n \"Dllhost.exe\" was detected as \".NET\" and name: \"Library\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * From AntiVirusProduct\" (Source: 6000024-OK~GetAntiVirus, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$31","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Dllhost.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" has an executable section named \".text\"\n \"Dllhost.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$32","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"No Antivirus\" (Indicator: \"antivirus\") in Source: 6000024-OK~GetAntiVirus","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Dllhost.exe\" (UID: 00000000-00005204) was launched with new environment variables: \"USERDNSDOMAIN=\"xiyoFPoc9rW74dT\"\"\n Process \"Dllhost.exe\" (UID: 00000000-00005204) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"Server.exe\" (UID: 00000000-00009496) was launched with new environment variables: \"SEE_MASK_NOZONECHECKS=\"1\"\"\n Process \"Server.exe\" (UID: 00000000-00009496) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"Server.exe\" (UID: 00000000-00009496) was launched with missing environment variables: \"USERDNSDOMAIN\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"kardan35.zapto.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NAME\")\n \"Dllhost.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"Dllhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"Dllhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"Dllhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Dllhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Dllhost.exe\" (UID: 00000000-00005204)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /sc minute /mo 1 /tn Server /tr %TEMP%\\\\Server. ...\" (UID: 00000000-00003212)\n Spawned process \"Server.exe\" (UID: 00000000-00009496)\n Spawned process \"Server.exe\" (UID: 00000000-00004368)\n Spawned process \"Server.exe\" (UID: 00000000-00008236)\n Spawned process \"Server.exe\" (UID: 00000000-00009212)\n Spawned process \"Server.exe\" (UID: 00000000-00001948)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Dllhost.exe\" (UID: 00000000-00005204)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /sc minute /mo 1 /tn Server /tr %TEMP%\\\\Server. ...\" (UID: 00000000-00003212)\n Spawned process \"Server.exe\" (UID: 00000000-00009496)\n Spawned process \"Server.exe\" (UID: 00000000-00004368)\n Spawned process \"Server.exe\" (UID: 00000000-00008236)\n Spawned process \"Server.exe\" (UID: 00000000-00009212)\n Spawned process \"Server.exe\" (UID: 00000000-00001948)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Dllhost.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Dllhost.exe\"\n \"Dllhost.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Server.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Dllhost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Server.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Dllhost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\Dllhost.exe]- [targetUID: 00000000-00002952]\n \"Server.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\Server.exe]- [targetUID: 00000000-00009212]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" queries basic process information of the \"C:\\3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (UID: 2952)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Dllhost.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Java update.exe\"\n \"Dllhost.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Java update.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\dllhost.exe\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" writes file \"%temp%\\dllhost.exe\"\n \"Dllhost.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\server.exe\"\n \"Dllhost.exe\" writes file \"%temp%\\server.exe\"\n \"Server.exe\" writes file \"%temp%\\server.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005204-00000C2B-2310200829\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, Cul\"\n \"10.0.0.0\"\n \"4.0.0.0\"\n \"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://wdcp.microsoft.com/wdcp.svc/submitreportrpc\" - Source: \"00000000-00002952.00000000.211500.011F0000.00000004.mdmp\")\n Found URL \"https://wdcp.microsoft.com/wdcp.svc/submitreportindows\" - Source: \"00000000-00002952.00000000.211500.011F0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"kardan35.zapto.org\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00002952\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLECFD979CAEFB26A678CB350D45ABC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002952.00000000.211500.011F0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE8CFBC3911968F0B654E7069CA935]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002952.00000000.211500.1BC20000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002952.00000000.211500.1BC20000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE8CFBC3911968F0B654E7069CA935]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002952.00000000.211500.1BC20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002952.00000000.211500.011F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Dllhost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Server.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Server.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00008236)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Dllhost.exe\" called \"GetComputerNameW\" (UID: 00000000-00005204)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"Dllhost.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Dllhost.exe\" called \"GetUserNameW\" (UID: 00000000-00005204)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; File: \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\")\n Found string \"elect * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002952-00000C2B-2299432710\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005204-00000C2B-2309282429\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005204-00000C2B-2309284376\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005204-00000C2B-2309284421\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Dllhost.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005204)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002952.00000000.211500.03090000.00000004.mdmp, 00000000-00002952.00000000.211500.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown -r -t 00\" (Indicator: \"shutdown \") in Source: 6000035-OK~Ind\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 6000035-OK~Ind\n Observed string: \"shutdown -s -t 00\" (Indicator: \"shutdown \") in Source: 6000035-OK~Ind","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Dllhost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Dllhost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\Dllhost.exe]- [targetUID: 00000000-00002952]\n \"Server.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\Server.exe]- [targetUID: 00000000-00009212]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Dllhost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" has section name .reloc with entropy \"6.500365071851166\"\n \"Dllhost.exe\" has section name .reloc with entropy \"6.500365071851166\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"Dllhost.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005204)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"Dllhost.exe\" issued a query \"select * from Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert - CnC Activity","description":"Detected alert \"ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)\" (SID: 2033132, Rev: 7, Severity: 1) categorized as \"Malware Command and Control Activity Detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","mitre_attack_id":"T1071","relevance":1,"id":"suricata-7","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Dllhost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\Dllhost.exe]- [targetUID: 00000000-00002952]\n \"Server.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\Server.exe]- [targetUID: 00000000-00009212]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"Dllhost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS UPDATE\"; Value: \"\"%TEMP%\\Dllhost.exe\" ..\")\n \"Dllhost.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWS UPDATE\"; Value: \"\"%TEMP%\\Dllhost.exe\" ..\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" wrote 25948 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Dllhost.exe\": 4d5a40000100000002000000ffff0000ff000000000000000a000000000000000e1fff0e00ff09ff21ff014cff2149742773202e4e4554204558452440000000504500004c010300ff26014d0000000000000000ff0002010b0108000010000000080000000000005e2e00000020000000400000000040000020000000020000 ...\n \"Dllhost.exe\" wrote 25948 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Server.exe\": 4d5a40000100000002000000ffff0000ff000000000000000a000000000000000e1fff0e00ff09ff21ff014cff2149742773202e4e4554204558452440000000504500004c010300ff26014d0000000000000000ff0002010b0108000010000000080000000000005e2e00000020000000400000000040000020000000020000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"winmgmts:\\\\\\\\.\\\\root\\\\SecurityCenter2\" (Indicator: \"winmgmts:\"; in File: \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\Dllhost.exe\"\" - (UID: 00000000-00002952)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"Dllhost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00005204)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$41","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at E1480000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /sc minute /mo 1 /tn Server /tr %TEMP%\\\\Server.exe\" (UID: 00000000-00003212)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Dllhost.exe\" (Handle: 1628)\n \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Dllhost.exe\" (Handle: 1628)\n \"Dllhost.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 1144)\n \"Dllhost.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\schtasks.exe\" (Handle: 1144)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 82.147.84.124 on port 1987","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_NjRAT\" matched process \"00000000-00002952\" as \"Detects NjRAT / Bladabindi / NjRAT Golden\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture the screen","description":"System.Drawing.Graphics::CopyFromScreen(System.Int32,System.Int32,System.Int32,System.Int32,System.Drawing.Size,System.Drawing.CopyPixelOperation) at dcfb0a3b24c3c469c4c205ddf2ccd3af-6000035-OK~Ind","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":3,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"Dllhost.exe\" issued a query \"Select * From AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe\" (UID: 00000000-00002952)\n Spawned process \"Dllhost.exe\" (UID: 00000000-00005204)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /sc minute /mo 1 /tn Server /tr %TEMP%\\\\Server.exe\" (UID: 00000000-00003212)\n Spawned process \"Server.exe\" (UID: 00000000-00009496)\n Spawned process \"Server.exe\" (UID: 00000000-00004368)\n Spawned process \"Server.exe\" (UID: 00000000-00008236)\n Spawned process \"Server.exe\" (UID: 00000000-00009212)\n Spawned process \"Server.exe\" (UID: 00000000-00001948)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Executes WMI queries in order to detect local security applications"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Executes WMI queries known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["bladabindi","njrat","rat","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6865a67a3e407931ae054ad7","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe","analysis_start_time":"2025-07-02T21:36:59+00:00","indicators_count":{"informative":116,"suspicious":46,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"82.147.84.124","port":1987,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}],"dns_resolutions":[{"domain":"kardan35.zapto.org","address":"82.147.84.124","ttl":60,"country":"Russian Federation","registrar_name":"TLDS L.L.C. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF4.NO-IP.COM","registrar_creation_date":"2001-08-10T02:24:14+00:00","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}],"processes":[{"pid":2952,"ppid":0,"name":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe","command_line":"","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","normalized_path":"C:\\3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c.exe","uid":"00000000-00002952","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":5204,"ppid":2952,"name":"Dllhost.exe","command_line":"","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","normalized_path":"%TEMP%\\Dllhost.exe","parent_uid":"00000000-00002952","uid":"00000000-00005204"},{"pid":3212,"ppid":5204,"name":"schtasks.exe","command_line":"schtasks /create /sc minute /mo 1 /tn Server /tr %TEMP%\\Server.exe","sha256":"ddde64f0f55751763c1bcd53de9cdffc0d725d45a8476464a2a0422661813004","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00005204","uid":"00000000-00003212"},{"pid":9496,"ppid":0,"name":"Server.exe","command_line":"","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","normalized_path":"%TEMP%\\Server.exe","uid":"00000000-00009496","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":4368,"ppid":0,"name":"Server.exe","command_line":"","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","normalized_path":"%TEMP%\\Server.exe","uid":"00000000-00004368","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":8236,"ppid":0,"name":"Server.exe","command_line":"","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","normalized_path":"%TEMP%\\Server.exe","uid":"00000000-00008236","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":9212,"ppid":0,"name":"Server.exe","command_line":"","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","normalized_path":"%TEMP%\\Server.exe","uid":"00000000-00009212","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":1948,"ppid":0,"name":"Server.exe","command_line":"","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","normalized_path":"%TEMP%\\Server.exe","uid":"00000000-00001948","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"}],"all_imported_dlls":["advapi32.dll","System.ni.dll","System.Core.ni.dll","SHCore.dll","edputil.dll","OneCoreUAPCommonProxyStub.dll","System.Management.ni.dll","wbemsvc.dll","ntdll.dll","ws2_32.dll","shlwapi.dll","vcruntime140_clr0400.dll","sspicli.dll","bcrypt.dll","wbemprox.dll","fastprox.dll","apphelp.dll","imm32.dll","psapi.dll","BCP47Langs.dll","ntmarta.dll","msctf.dll","FWPUCLNT.DLL","avicap32.dll","mscoree.dll","sechost.dll","clrjit.dll","mswsock.dll","winmm.dll","taskschd.dll","ucrtbase.dll","gdi32full.dll","kernel.appcore.dll","profapi.dll","gpapi.dll","urlmon.dll","srvcli.dll","comctl32.dll","kernel32.dll","fltLib.dll","msvcrt.dll","System.Drawing.ni.dll","virtdisk.dll","rsaenh.dll","cryptbase.dll","CustomMarshalers.dll","oleaut32.dll","vcruntime140_1_clr0400.dll","AppResolver.dll","IPHLPAPI.DLL","msvcp_win.dll","MpClient.dll","wintrust.dll","msasn1.dll","netutils.dll","msvfw32.dll","wbemdisp.dll","CustomMarshalers.ni.dll","VxSSL64.dll","ole32.dll","ucrtbase_clr0400.dll","userenv.dll","clbcatq.dll","win32u.dll","version.dll","mscorlib.ni.dll","System.Windows.Forms.ni.dll","SZ7YE897.dll","shell32.dll","wbemcomn.dll","gdi32.dll","amsi.dll","cfgmgr32.dll","iertutil.dll","dnsapi.dll","sxs.dll","rpcrt4.dll","user32.dll","mscoreei.dll","bcryptprimitives.dll","MpOAV.dll","windows.storage.dll","propsys.dll","Windows.StateRepositoryPS.dll","cryptsp.dll","clr.dll","crypt32.dll","WinTypes.dll","System.Configuration.ni.dll","System.Xml.ni.dll","nsi.dll","WMINet_Utils.dll","uxtheme.dll","wldp.dll","Microsoft.VisualBasic.ni.dll","rasadhlp.dll","wmiutils.dll","coml2.dll","KernelBase.dll","combase.dll","xmllite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Server.exe","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Dllhost.exe","sha256":"3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}],"files_written":[{"path":"%TEMP%\\Dllhost.exe","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Java update.exe","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"path":"%TEMP%\\Server.exe","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Update","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2952:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2952:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Local\\SM0:2952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Windows Update","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Local\\SM0:2952:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"SM0:2952:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5204:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5204:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Local\\SM0:5204:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"SM0:5204:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Local\\SM0:5204:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]},{"name":"Local\\SM0:9496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6865a67a3e407931ae054ad7"}]}]}},"report_ids":{"sandbox_job_ids":["6865a67a3e407931ae054ad7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware.SLcbg.Generic Sample 3e617b7cf7f9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3e617b7cf7f9…. Malware family: Malware.SLcbg.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware.SLcbg.Generic Sample 3e617b7cf7f9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3e617b7cf7f9…. Malware family: Malware.SLcbg.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3e617b7cf7f9d6e1bb8fdd06ef64a6e6aec20132549884fafbbd5bb6118c9a7c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware.SLcbg.Generic Sample 3e617b7cf7f9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3e617b7cf7f9…. Malware family: Malware.SLcbg.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 12 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]