24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 60:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Marsilia.Generic Sample 5eed2b583248… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5eed2b583248…. Malware family: Marsilia.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5eed2b5832483191e67f2ffbdcf349a6256039a8a7f934fb6bb9188873f8a73b","keywords":["Malicious","Marsilia.Generic","malware analysis","sandbox report","threat intelligence","5eed2b5832483191e67f2ffbdcf349a6256039a8a7f934fb6bb9188873f8a73b"],"about":{"@type":"SoftwareApplication","name":"000.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"5eed2b5832483191e67f2ffbdcf349a6256039a8a7f934fb6bb9188873f8a73b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Marsilia.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T645,Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "000.exe") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp")26:T2879,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005736-00000BC0-3572566308") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp")27:T6e0,"000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\LOCALSERVER32") "000.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\LOCALSERVER") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\LOCALSERVER") "000.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\ELEVATION") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\ELEVATION") "000.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\TREATAS") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\TREATAS") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS") "000.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MEDIA\WMSDK\METERING") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS MEDIA FOUNDATION\PLATFORM") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\MEDIAPLAYER\MLS\EXTENSIONS") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "000.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\MEDIAPLAYER\PREFERENCES\") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\MEDIAPLAYER\PREFERENCES") "000.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\MEDIAPLAYER\PREFERENCES\") "000.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\MEDIAPLAYER\PREFERENCES")28:T97c,"000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3571376871 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3571384444 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3571631064 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3571639576 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3573290489 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3573298892 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3573476191 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3573485348 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3575523221 [PID: 5736] "000.exe" queried SystemProcessInformation at 00000000-00005736-00000C15-3575544018 [PID: 5736] "cmd.exe" queried SystemProcessInformation at 00000000-00003476-00000C15-3575935003 [PID: 3476] "cmd.exe" queried SystemProcessInformation at 00000000-00003476-00000C15-3575943559 [PID: 3476] "cmd.exe" queried SystemProcessInformation at 00000000-00003476-00000C15-3576447710 [PID: 3476] "cmd.exe" queried SystemProcessInformation at 00000000-00003476-00000C15-3576465966 [PID: 3476] "net1.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-3581430928 [PID: 8152] "net1.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-3581448949 [PID: 8152] "net1.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-3582237657 [PID: 8152] "net1.exe" queried SystemProcessInformation at 00000000-00008152-00000C15-3582255837 [PID: 8152] "WMIC.exe" queried SystemProcessInformation at 00000000-00000376-00000C15-3586879318 [PID: 376] "WMIC.exe" queried SystemProcessInformation at 00000000-00000376-00000C15-3586890552 [PID: 376] "WMIC.exe" queried SystemProcessInformation at 00000000-00000376-00000C15-3587826972 [PID: 376] "WMIC.exe" queried SystemProcessInformation at 00000000-00000376-00000C15-3587980406 [PID: 376] "WMIC.exe" queried SystemProcessInformation at 00000000-00000376-00000C15-3589681338 [PID: 376] "WMIC.exe" queried SystemProcessInformation at 00000000-00000376-00000C15-3589725762 [PID: 376] "WMIC.exe" queried SystemProcessInformation at 00000000-00001076-00000C15-3591705439 [PID: 1076]29:T499,Found string "Validation of public key failed." (Indicator: "public key"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "The Software Licensing Service reported that the product could not be activated. The certificate cannot be used because its private key is exportable." (Indicator: "private key"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp")2a:T438,Found XOR loop in file "Interop.WMPLib.dll" at offset 166042; code bytes = 8030 Found XOR loop in file "Interop.WMPLib.dll" at offset 185106; code bytes = 8030 Found XOR loop in file "AxInterop.WMPLib.dll" at offset 17271; code bytes = 30d0 Found XOR loop in file "AxInterop.WMPLib.dll" at offset 17283; code bytes = 30d0 Found XOR loop in file "AxInterop.WMPLib.dll" at offset 17295; code bytes = 30d0 Found XOR loop in file "AxInterop.WMPLib.dll" at offset 24969; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6617887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6617899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6617911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6625585; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6076680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6086612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6820426; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6839490; code bytes = 80302b:Tfff,file/memory contains long string with (Indicator: "sendmessage"; File: "rniw.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "000.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "000.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "000.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "000.exe") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005736-00000C2C-3574260652") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005736-00000C2C-3574260681") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005736-00000C2C-3575445929") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005736-00000C2C-3575445952") Found reference to API "sendMessage" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.5A882000.00000002.mdmp, 00000000-00005736.00000000.292579.6A920000.00000004.mdmp, 00000000-00005736.00000002.296420.6A920000.00000004.mdmp") Found reference to API "set_OnSendMessageComplete" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.5A882000.00000002.mdmp, 00000000-00005736.00000000.292579.6A920000.00000004.mdmp, 00000000-00005736.00000002.296420.6A920000.00000004.mdmp") Found reference to API "OnSendMessageComplete" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.5A882000.00000002.mdmp, 00000000-00005736.00000000.292579.6A920000.00000004.mdmp, 00000000-00005736.00000002.296420.6A920000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "sendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.74570000.00000004.mdmp, 00000000-00005736.00000001.294500.74570000.00000004.mdmp, 00000000-00005736.00000002.296420.74570000.00000004.mdmp") Found reference to API "r/OnSendMessageCompleteWWW" (Indicator: "sendmessage"; Source: "00000000-00005736.00000000.292579.74570000.00000004.mdmp, 00000000-00005736.00000001.294500.74570000.00000004.mdmp, 00000000-00005736.00000002.296420.74570000.00000004.mdmp")2c:T1396,"000.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000009000000000000001800000000000000ef10249af7ec00000800000000000000ffffffffffffffff3400000000000000b42ee02cf97f000098ecef257a000000db040449f97f000000000000f97f00002a962946f97f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000000edef257a000000080000000000000000000000000000000000000000000000bf19249af7ec0000c3f00249f97f00000000ba5842020000a7130349f97f000058edef25 (UID: 00000000-00005736) "000.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736) "000.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736) "000.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5c7342020000000000000000000051ed0649f97f0000000000004202000000000000000000009a9e860588d500002a00000000000000907c9f58420200008fec0649f97f0000e0ac5c7342020000e0ac5c7342020000000000000000000000000000f97f0000ffffff7f2447000000000000000000000000000000000000d8ce5073420200002a0000000000000069c3097342020000310000000000000000030000000000000403000000000000110001100000000000c0ef257a00000003a36246f97f000000c0ef257a00000000000000000000002b00000000000000000000000000000020b00f7342020000b43f0e7342020000e0ce5073 (UID: 00000000-00005736) "000.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0000249f97f00000000000000000000000000000000000000000000000000000000db48f97f00001ec4032df97f00005013032df97f00001844e448f97f00002831e448f97f0000fca2e448f97f00000000fb2cf97f000000000000f97f0000f800fb2cf97f000005000500000000008667e448f97f00000000000000000000deb10549f97f00000100000042020000000000000000000010a8a0584202000088e2ef257a0000002afd860588d5000051a70549f97f00000500000000000000f800fb2cf97f000001000000000000000000000000000000d0e2ef257a00000010331349f97f000024e7ef257a0000007964022df97f000000020000 (UID: 00000000-00005736) "000.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000003e060749f97f000000000000000000000000000000000000000000000000000060f3a3584202000020efa3584202000006060749f97f000000000000000000004a96860588d50000c0e3d313f97f0000b0b7ef257a000000000000000000000090e4cb13f97f000060f3a35842020000d7000749f97f0000000000000000000000000000000000000200000000000000a0f3a35842020000f05d7d14f97f00000000c213f97f0000487d7e14f97f00003ffe0649f97f0000c0e3d313f97f000024bdef257a00000040d2a45842020000487d7e14f97f0000b0b7ef257a0000000000c213f97f000060f3a35842027600f199822d5a8b804b8754f7cd (UID: 00000000-00005736) "000.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000fe20c713f97f0000c0e6ef257a00000004000000000000000000000000000000000000000000000000000000000000000000000000000000320000000000000020030000000000000000725a420200000b8e0449f97f00000000725a42020000020000004202000018030000000000002003000000000000a004725a4202000048e6ef257a00000000000000000000000300000000000000000000000000000069ee0849f97f0000400000000000000030000000000000000000725a4202000032890449f97f0000000000000000000069ee0849f97f00003000000000000000000000000400000060d4725a4202000058d4725a420200005ac68605 (UID: 00000000-00005736) "000.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736)2d:T4a3,"000.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "net1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WMIC.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "shutdown.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2e:Tac7,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "000.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "000.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "000.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "000.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "000.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp")2f:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp")30:T6df,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "000.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "000.exe") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004384.00000000.295990.A1B90000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "9790,5180,3024,,RtlGetVersion,NTDLL.dll,"01:16:07.437",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005736.00000000.292579.58950000.00000004.mdmp, 00000000-00005736.00000001.294500.58950000.00000004.mdmp, 00000000-00005736.00000002.296420.58950000.00000004.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp")31:Ta3f,"000.exe" queries volume information of "C:\000.exe" at 00000000-00005736-00000C17-3572570005 "000.exe" queries volume information of "C:\AxInterop.WMPLib.dll" at 00000000-00005736-00000C17-3573722792 "000.exe" queries volume information of "C:\Interop.WMPLib.dll" at 00000000-00005736-00000C17-3573760031 "000.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb" at 00000000-00005736-00000C17-3577256047 "000.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb" at 00000000-00005736-00000C17-3577295078 "000.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb" at 00000000-00005736-00000C17-3577302512 "000.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb" at 00000000-00005736-00000C17-3577307665 "000.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb" at 00000000-00005736-00000C17-3577312623 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578012845 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578026528 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578091520 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578093175 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578195902 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578197568 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578235589 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578237294 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578288434 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578290065 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578370406 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578372066 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578413130 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578414770 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578453862 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578455660 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-357851294932:T896,"000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578012845 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578026528 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578091520 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578093175 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578195902 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578197568 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578235589 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578237294 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578288434 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578290065 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578370406 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578372066 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578413130 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578414770 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578453862 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578455660 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578512949 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578514576 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578551211 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578552798 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578625427 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578627200 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578667340 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-3578669300 "000.exe" queries volume information of "C:\" at 00000000-00005736-00000C17-358076967733:T2273,"000.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00005736) "000.exe" called "LoadLibrary" with a parameter ext-ms-win-core-resourcepolicy-l1-1-0.dll (UID: 00000000-00005736) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003476) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003476) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003476) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003476) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008152) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008152) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008152) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008152) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000376) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000376) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000376) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000376) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000376) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000376) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000376) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001076) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001076) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001076) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001076) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004384) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004384) "shutdown.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004384) "shutdown.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004384)34:Td555,"000.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter OpenAdapter (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter D3DKMTEnumAdapters2 (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter CreateGameConfigStoreClient (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter FreeGameConfigStoreClient (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005736) "000.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00005736) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003476) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003476) "net1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008152) "net1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008152) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000376) "WMIC.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001076) "WMIC.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001076) "shutdown.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004384) "shutdown.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004384)35:Tffd5,Found reference to API (Indicator: "GetTempPath"; File: "000.exe") Found reference to API (Indicator: "GetObject"; File: "000.exe") Found reference to API (Indicator: "BitBlt"; File: "000.exe") Found reference to API (Indicator: "GetDIBits"; File: "000.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "000.exe") Found reference to API (Indicator: "SelectObject"; File: "000.exe") Found reference to API (Indicator: "GetObjectA"; File: "000.exe") Found reference to API (Indicator: "DeleteDC"; File: "000.exe") Found reference to API (Indicator: "GetStockObject"; File: "000.exe") Found reference to API (Indicator: "DeleteObject"; File: "000.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "000.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "000.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "000.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "000.exe") Found reference to API (Indicator: "GetProcAddress"; File: "000.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "000.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "000.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "000.exe") Found reference to API (Indicator: "WriteFile"; File: "000.exe") Found reference to API (Indicator: "CloseHandle"; File: "000.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "000.exe") Found reference to API (Indicator: "DeleteFileA"; File: "000.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "000.exe") Found reference to API (Indicator: "CreateFileA"; File: "000.exe") Found reference to API (Indicator: "FindResourceA"; File: "000.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "000.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "000.exe") Found reference to API (Indicator: "HeapSize"; File: "000.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "000.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "000.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "000.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "000.exe") Found reference to API (Indicator: "FreeLibrary"; File: "000.exe") Found reference to API (Indicator: "GetTempPathA"; File: "000.exe") Found reference to API (Indicator: "GetVersionExA"; File: "000.exe") Found reference to API (Indicator: "HeapFree"; File: "000.exe") Found reference to API (Indicator: "SetFilePointer"; File: "000.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "000.exe") Found reference to API (Indicator: "ReadFile"; File: "000.exe") Found reference to API (Indicator: "LoadResource"; File: "000.exe") Found reference to API (Indicator: "TerminateProcess"; File: "000.exe") Found reference to API (Indicator: "ExitProcess"; File: "000.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "000.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "000.exe") Found reference to API (Indicator: "SizeofResource"; File: "000.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "000.exe") Found reference to API (Indicator: "GetFileSize"; File: "000.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "000.exe") Found reference to API (Indicator: "HeapAlloc"; File: "000.exe") Found reference to API (Indicator: "TlsAlloc"; File: "000.exe") Found reference to API (Indicator: "SetLastError"; File: "000.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "000.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "000.exe") Found reference to API (Indicator: "Sleep"; File: "000.exe") Found reference to API (Indicator: "HeapCreate"; File: "000.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "000.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "000.exe") Found reference to API (Indicator: "HeapDestroy"; File: "000.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "000.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "000.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "000.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "000.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "000.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "000.exe") Found reference to API (Indicator: "CoInitialize"; File: "000.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "000.exe") Found reference to API (Indicator: "ShellExecuteExA"; File: "000.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "000.exe") Found reference to API (Indicator: "GetWindowRect"; File: "000.exe") Found reference to API (Indicator: "TranslateMessage"; File: "000.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "000.exe") Found reference to API (Indicator: "EnumWindows"; File: "000.exe") Found reference to API (Indicator: "CharUpperA"; File: "000.exe") Found reference to API (Indicator: "GetSysColor"; File: "000.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "000.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "000.exe") Found reference to API (Indicator: "EnableWindow"; File: "000.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "000.exe") Found reference to API (Indicator: "RegisterClassA"; File: "000.exe") Found reference to API (Indicator: "GetParent"; File: "000.exe") Found reference to API (Indicator: "PeekMessageA"; File: "000.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "000.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "000.exe") Found reference to API (Indicator: "MessageBoxA"; File: "000.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "000.exe") Found reference to API (Indicator: "SetRect"; File: "000.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "000.exe") Found reference to API (Indicator: "RemovePropA"; File: "000.exe") Found reference to API (Indicator: "GetDC"; File: "000.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "000.exe") Found reference to API (Indicator: "CreateAcceleratorTableA"; File: "000.exe") Found reference to API (Indicator: "DrawTextA"; File: "000.exe") Found reference to API (Indicator: "RedrawWindow"; File: "000.exe") Found reference to API (Indicator: "DestroyWindow"; File: "000.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "000.exe") Found reference to API (Indicator: "SetPropA"; File: "000.exe") Found reference to API (Indicator: "SendMessageA"; File: "000.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "000.exe") Found reference to API (Indicator: "DestroyIcon"; File: "000.exe") Found reference to API (Indicator: "GetFocus"; File: "000.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "000.exe") Found reference to API (Indicator: "ShowWindow"; File: "000.exe") Found reference to API (Indicator: "FillRect"; File: "000.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "000.exe") Found reference to API (Indicator: "GetKeyState"; File: "000.exe") Found reference to API (Indicator: "DefFrameProcA"; File: "000.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "000.exe") Found reference to API (Indicator: "IsChild"; File: "000.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "000.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "000.exe") Found reference to API (Indicator: "SetWindowPos"; File: "000.exe") Found reference to API (Indicator: "ReleaseDC"; File: "000.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "000.exe") Found reference to API (Indicator: "LoadCursorA"; File: "000.exe") Found reference to API (Indicator: "SetFocus"; File: "000.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "000.exe") Found reference to API (Indicator: "GetMessageA"; File: "000.exe") Found reference to API (Indicator: "GetClientRect"; File: "000.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "000.exe") Found reference to API (Indicator: "LoadIconA"; File: "000.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "000.exe") Found reference to API (Indicator: "PostMessageA"; File: "000.exe") Found reference to API (Indicator: "TranslateAcceleratorA"; File: "000.exe") Found reference to API (Indicator: "GetWindow"; File: "000.exe") Found reference to API (Indicator: "GetClassNameA"; File: "000.exe") Found reference to API (Indicator: "CharLowerA"; File: "000.exe") Found reference to API (Indicator: "GetPropA"; File: "000.exe") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000376.00000000.293518.44720000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00000376.00000000.293518.44720000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "NtInitiatePowerAction"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "SetFirmwareEnvironmentVariableW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetFirmwareEnvironmentVariableW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "NtPowerInformation"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SHBrowseForFolder"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CharLowerA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "RemovePropA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetPropA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetPropA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "TranslateAcceleratorA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DefFrameProcA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetWindowText"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005736.00000000.292579.74570000.00000004.mdmp")36:T578,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "000.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "000.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "000.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp")37:T5ac,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "000.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004384.00000000.295990.75B55000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp")38:T1b96,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 000.exe "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 000.exe "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 6000004-Form1~go_to_payload "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" in Source: 6000004-Form1~go_to_payload "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop" in Source: 6000004-Form1~go_to_payload "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00000376.00000000.293518.37CBE000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00000376.00000000.293518.44720000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00000376.00000000.293518.44720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00000376.00000000.293518.44720000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00001076.00000000.293856.47B60000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00001076.00000000.293856.47B60000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Reliability" in Source: 00000000-00004384.00000000.295990.75B55000.00000002.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00005736.00000000.292579.58950000.00000004.mdmp 00000000-00005736.00000001.294500.58950000.00000004.mdmp 00000000-00005736.00000002.296420.58950000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005736.00000000.292579.58950000.00000004.mdmp 00000000-00005736.00000001.294500.58950000.00000004.mdmp 00000000-00005736.00000002.296420.58950000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005736.00000000.292579.58950000.00000004.mdmp 00000000-00005736.00000001.294500.58950000.00000004.mdmp 00000000-00005736.00000002.296420.58950000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_CLASSES_ROOT\txtfile\DefaultIcon" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp 00000000-00005736.00000001.294500.5A920000.00000004.mdmp 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F7AFD75B-BF8C-4A11-BDB9-04AD66182F84}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{777D0CFF-0375-43B9-8532-FB04A4903593}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{271C3902-6095-4C45-A22F-20091816EE9E}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp39:T9d6,Process 000.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5736:304:WilStaging_02" Process 000.exe created mutex with name "Local\SM0:5736:304:WilStaging_02" Process 000.exe created mutex with name "Local\SM0:5736:120:WilError_01" Process 000.exe created mutex with name "SM0:5736:120:WilError_01" Process 000.exe created mutex with name "WindowsMediaStoreMutex" Process 000.exe created mutex with name "__DDrawExclMode__" Process 000.exe created mutex with name "SM0:5736:304:WilStaging_02" Process 000.exe created mutex with name "__DDrawCheckExclMode__" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:14" Process 000.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5736:304:WilStaging_02" Process 000.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5736:120:WilError_01" Process 000.exe created mutex with name "\Sessions\1\BaseNamedObjects\WindowsMediaStoreMutex" Process 000.exe created mutex with name "\BaseNamedObjects\{815ead30-0000-0000-0000-501f00000000}_720896_58657" Process 000.exe created mutex with name "\BaseNamedObjects\{815ead30-0000-0000-0000-501f00000000}_720896_58657:x" Process 000.exe created mutex with name "\BaseNamedObjects\{815ead30-0000-0000-0000-501f00000000}_720896_58657:splk:5736" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:1" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:2" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:3" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:4" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:5" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:6" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:7" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:8" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:9" Process 000.exe created mutex with name "\BaseNamedObjects\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:10"3a:T4ba,"000.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "000.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "000.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "000.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "000.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "000.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "000.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "000.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135]3b:T2fe0,"SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00000376.00000000.293518.37CBE000.00000002.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00000376.00000000.293518.44720000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00000376.00000000.293518.44720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00000376.00000000.293518.44720000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00001076.00000000.293856.47B60000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00001076.00000000.293856.47B60000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Reliability" in Source: 00000000-00004384.00000000.295990.75B55000.00000002.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00005736.00000000.292579.58950000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005736.00000000.292579.58950000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005736.00000000.292579.58950000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "HKEY_CLASSES_ROOT\txtfile\DefaultIcon" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F7AFD75B-BF8C-4A11-BDB9-04AD66182F84}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{777D0CFF-0375-43B9-8532-FB04A4903593}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{271C3902-6095-4C45-A22F-20091816EE9E}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005736.00000000.292579.74570000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00005736.00000001.294500.58950000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005736.00000001.294500.58950000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005736.00000001.294500.58950000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "HKEY_CLASSES_ROOT\txtfile\DefaultIcon" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000001.294500.5A920000.00000004.mdmp "Software\Classes\PackagedCom" in Source: 00000000-00005736.00000001.294500.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00005736.00000001.294500.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{DE77BA04-3C92-4D11-A1A5-42352A53E0E3}" in Source: 00000000-00005736.00000001.294500.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{f81b1b56-7613-4ee4-bc05-1fab5de5c07e}\InProcServer32" in Source: 00000000-00005736.00000001.294500.74570000.00000004.mdmp "ProgramData=C:\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005736.00000001.294500.79020000.00000004.mdmp "e\Software\Classes\CLSID\{000003" in Source: 00000000-00005736.00000001.294500.79020000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E}\Instance" in Source: 00000000-00005736.00000001.294500.79020000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005736.00000001.294500.79020000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005736.00000001.294500.79020000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{62079164-233B-41F8-A80F-F01705F514A8}" in Source: 00000000-00005736.00000001.294500.79020000.00000004.mdmp "\Software\C" in Source: 00000000-00005736.00000001.294500.79020000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00005736.00000002.296420.58950000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005736.00000002.296420.58950000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005736.00000002.296420.58950000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_CLASSES_ROOT\txtfile\DefaultIcon" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005736.00000002.296420.5A920000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00005736.00000002.296420.74570000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{f81b1b56-7613-4ee4-bc05-1fab5de5c07e}\InProcServer32" in Source: 00000000-00005736.00000002.296420.74570000.00000004.mdmp "ProgramData=C:\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005736.00000002.296420.79020000.00000004.mdmp "e\Software\Classes\CLSID\{000003" in Source: 00000000-00005736.00000002.296420.79020000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E}\Instance" in Source: 00000000-00005736.00000002.296420.79020000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00005736.00000002.296420.79020000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005736.00000002.296420.79020000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{62079164-233B-41F8-A80F-F01705F514A8}" in Source: 00000000-00005736.00000002.296420.79020000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008152.00000000.293155.35FC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00008152.00000000.293155.35FC0000.00000002.mdmp3c:T3140,"000.exe" loaded module "KERNEL32" at base 7ff948790000 "000.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff945fc0000 "000.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff945fc0000 "000.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff945fc0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff948840000 "000.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff945fc0000 "000.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff945fc0000 "000.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff945fc0000 "000.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff920ab0000 "000.exe" loaded module "ADVAPI32.DLL" at base 7ff9470b0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff920a00000 "000.exe" loaded module "SHLWAPI.DLL" at base 7ff946ed0000 "000.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff945400000 "000.exe" loaded module "VERSION.DLL" at base 7ff93bad0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff91ff30000 "000.exe" loaded module "USER32.DLL" at base 7ff948db0000 "000.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff945fc0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "000.exe" loaded module "MSCOREE.DLL" at base 7ff921a00000 "000.exe" loaded module "NTDLL" at base 7ff949020000 "000.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff948aa0000 "000.exe" loaded module "PSAPI.DLL" at base 7ff948fe0000 "000.exe" loaded module "RPCRT4.DLL" at base 7ff946890000 "000.exe" loaded module "KERNEL32.DLL" at base 7ff948790000 "000.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff9179a0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "000.exe" loaded module "OLE32.DLL" at base 7ff947160000 "000.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9439f0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "000.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff948aa0000 "000.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff945fc0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff91fd20000 "000.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff916d30000 "000.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff91fb20000 "000.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff915c80000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "000.exe" loaded module "UXTHEME.DLL" at base 7ff9439f0000 "000.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff915200000 "000.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff91f9e0000 "000.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff914950000 "000.exe" loaded module "NTDLL.DLL" at base 7ff949020000 "000.exe" loaded module "SHELL32.DLL" at base 24272fe0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "000.exe" loaded module "BCRYPT.DLL" at base 7ff944ed0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff944810000 "000.exe" loaded module "IMM32.DLL" at base 7ff948840000 "000.exe" loaded module "COMCTL32.DLL" at base 7ff92cfb0000 "000.exe" loaded module "GDI32.DLL" at base 24258ba0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff946720000 "000.exe" loaded module "MFPLAT.DLL" at base 7ff932710000 "000.exe" loaded module "%WINDIR%\SYSTEM32\WMPLOC.DLL" at base 24274770000 "000.exe" loaded module "%WINDIR%\SYSTEM32\WMP.DLL" at base 7ff913c20000 "000.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ff921fd0000 "000.exe" loaded module "SXS.DLL" at base 7ff9451d0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ff93edd0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "000.exe" loaded module "OLEAUT32.DLL" at base 7ff946f30000 "000.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff925a50000 "000.exe" loaded module "AMSI.DLL" at base 7ff9322c0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff93bad0000 "000.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff9322a0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\P1H9DL1E.DLL" at base 7ff925a00000 "000.exe" loaded module "ATLTHUNK.DLL" at base 7ff927720000 "000.exe" loaded module "GDIPLUS.DLL" at base 7ff921fd0000 "000.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff945fc0000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "000.exe" loaded module "%WINDIR%\SYSTEM32\WMPEFFECTS.DLL" at base 7ff925880000 "000.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 0 "000.exe" loaded module "%WINDIR%\SYSTEM32\MFCORE.DLL" at base 7ff922690000 "000.exe" loaded module "%WINDIR%\SYSTEM32\MFMP4SRCSNK.DLL" at base 7ff9137f0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\EVR.DLL" at base 7ff913550000 "000.exe" loaded module "DXVA2.DLL" at base 7ff931740000 "000.exe" loaded module "D3D9.DLL" at base 7ff9133b0000 "000.exe" loaded module "AVRT.DLL" at base 7ff9414d0000 "000.exe" loaded module "D3D10WARP.DLL" at base 7ff93f3e0000 "000.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ff943d30000 "000.exe" loaded module "DWMAPI.DLL" at base 7ff943c20000 "000.exe" loaded module "%WINDIR%\SYSTEM32\COLORCNV.DLL" at base 7ff925840000 "000.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.MEDIA.DLL" at base 7ff912d40000 "000.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff9374e0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff940f70000 "000.exe" loaded module "%WINDIR%\SYSTEM32\MSMPEG2VDEC.DLL" at base 7ff912ae0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\MFPS.DLL" at base 7ff912720000 "000.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ff948db0000 "000.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ff948db0000 "000.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ff948aa0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff947160000 "000.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff941770000 "000.exe" loaded module "URLMON.DLL" at base 7ff939db0000 "000.exe" loaded module "SSPICLI.DLL" at base 7ff945270000 "000.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff945480000 "000.exe" loaded module "%WINDIR%\SYSTEM32\PROVSVC.DLL" at base 7ff9336a0000 "000.exe" loaded module "WININET.DLL" at base 7ff933750000 "000.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ff9279d0000 "000.exe" loaded module "WINHTTP.DLL" at base 7ff941930000 "000.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff9279d0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff944c00000 "000.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 24272fe0000 "000.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 2425a730000 "cmd.exe" loaded module "KERNEL32" at base 7ff948790000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff945fc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff945fc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff945fc0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff948840000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff945fc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff945fc0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff945fc0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff920ab0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff948790000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff949020000 "net1.exe" loaded module "KERNEL32" at base 7ff948790000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff945fc0000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff945fc0000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff945fc0000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff948840000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff945fc0000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff945fc0000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff945fc0000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff920ab0000 "net1.exe" loaded module "RPCRT4.DLL" at base 7ff946890000 "WMIC.exe" loaded module "KERNEL32" at base 7ff948790000 "WMIC.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff945fc0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff945fc0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff945fc0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff948840000 "WMIC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff945fc0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff945fc0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff945fc0000 "WMIC.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff920ab0000 "WMIC.exe" loaded module "RPCRT4.DLL" at base 7ff946890000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff945fc0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff93ad20000 "WMIC.exe" loaded module "SSPICLI.DLL" at base 7ff945270000 "WMIC.exe" loaded module "KERNEL32.DLL" at base 7ff948790000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ff936d90000 "WMIC.exe" loaded module "USER32.DLL" at base 7ff948db0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff945fc0000 "WMIC.exe" loaded module "MSISO.DLL" at base 7ff931340000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff9439f0000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ff9438a0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff939480000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff945fc0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff945fc0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff938510000 "shutdown.exe" loaded module "KERNEL32" at base 7ff948790000 "shutdown.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff945fc0000 "shutdown.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff945fc0000 "shutdown.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff945fc0000 "shutdown.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff948840000 "shutdown.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff945fc0000 "shutdown.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff945fc0000 "shutdown.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff945fc0000 "shutdown.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff920ab0000 "shutdown.exe" loaded module "USER32.DLL" at base 7ff948db00003d:Tfb5,"000.exe" touched "File Scheme Handler" (Path: "HKCU\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}") "000.exe" touched "MPEG4 Byte Stream Handler" (Path: "HKCU\CLSID\{271C3902-6095-4C45-A22F-20091816EE9E}\TREATAS") "000.exe" touched "MF Video Presenter 2" (Path: "HKCU\CLSID\{F7AFD75B-BF8C-4A11-BDB9-04AD66182F84}\TREATAS") "000.exe" touched "Tearless Window Presenter" (Path: "HKCU\CLSID\{A0A7A57B-59B2-4919-A694-ADD0A526C373}\TREATAS") "000.exe" touched "MF Video Mixer" (Path: "HKCU\CLSID\{E474E05A-AB65-4F6A-827C-218B1BAAF31F}\TREATAS") "000.exe" touched "EVR Graph Optimizer" (Path: "HKCU\CLSID\{62079164-233B-41F8-A80F-F01705F514A8}\TREATAS") "000.exe" touched "Color Converter DMO" (Path: "HKCU\CLSID\{98230571-0087-4204-B020-3282538E57D3}\TREATAS") "000.exe" touched "Microsoft H264 Video Decoder MFT" (Path: "HKCU\CLSID\{62CE7E72-4C71-4D20-B15D-452831A87D9D}\TREATAS") "000.exe" touched "Windows Media Player" (Path: "HKCU\CLSID\{6BF52A52-394A-11D3-B153-00C04F79FAA6}\TREATAS") "000.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "000.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "000.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "000.exe" touched "Windows Media Player Effects Activate" (Path: "HKCU\CLSID\{777D0CFF-0375-43B9-8532-FB04A4903593}\TREATAS") "000.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "000.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "000.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "000.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "000.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "000.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "000.exe" touched "Home Group Member Status" (Path: "HKCU\CLSID\{DE77BA04-3C92-4D11-A1A5-42352A53E0E3}\TREATAS") "000.exe" touched "MF MPEG-4 Property Handler" (Path: "HKCU\CLSID\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E}\OVERRIDEFILESYSTEMPROPERTIES") "000.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "000.exe" touched "Shell Oplock Provider" (Path: "HKCU\CLSID\{E2EB4CA4-C96E-4DA4-94B1-673C8334A5BB}\TREATAS") "000.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "000.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "000.exe" touched "Ptype_PSFactory" (Path: "HKCU\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "000.exe" touched "Windows.Media" (Path: "HKCU\CLSID\{0B4C227F-2394-43FF-BA59-BC762F5C46EA}\TREATAS") "000.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{AD4C1B00-4BF7-422F-9175-756693D9130D}\TREATAS") "WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")3e:Tf09,"000.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Interop.WMPLib.dll" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "rniw.exe" file has an entrypoint instructions - "push 0x180,push 0,push 0x41343c,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x413440], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x41343c], eax,call 0x405000,mov eax, 0x41230e,mov dword ptr [0x41347c], eax,call 0x40ef00,call 0x40ecec,call 0x40d1f3,call 0x40cd23," "AxInterop.WMPLib.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3f:T409,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00005736-00000BC1-3575352018] Observed system executable string:"%WINDIR%\system32\taskkill.exe" [Source: 00000000-00003476-00000C47-2724101995] Observed system executable string:"%WINDIR%\System32\taskkill.exe" [Source: 00000000-00003476-00000BC0-3576824926] Observed system executable string:"%WINDIR%\System32\net.exe" [Source: 00000000-00003476-00000BC0-3579917860] Observed system executable string:"%WINDIR%\System32\wbem\WMIC.exe" [Source: 00000000-00003476-00000BC0-3585675071] Observed system executable string:"%WINDIR%\System32\shutdown.exe" [Source: 00000000-00003476-00000BC0-3624292699] Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00003476-00000C47-10144381638] Observed system executable string:"%WINDIR%\System32\Wbem\WMIC.exe" [Source: 00000000-00003476-00000C47-23960403443] Observed system executable string:"%WINDIR%\system32\shutdown.exe" [Source: 00000000-00003476-00000C47-116656039750]40:T714,"000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "000.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WMIC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")41:Ted5,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005736-00000C2E-1510124081] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005736-00000C2B-3572210250] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005736-00000C2B-3572307891] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005736-00000C2B-3572387958] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00005736-00000C2B-3572542160] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005736-00000C2B-3572570809] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005736-00000C2B-3572637858] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00005736-00000C2B-3572740550] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00005736-00000C2B-3572785448] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00005736-00000C2B-3572815062] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00005736-00000C2B-3572851084] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005736-00000C2B-3572954184] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00005736-00000C2B-3573089904] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00005736-00000C2B-3573116032] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00005736-00000C2B-3573163046] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005736-00000C2B-3573413076] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005736-00000C2B-3574078457] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005736-00000C2B-3574104483] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005736-00000C2B-3574180210] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005736-00000C2B-3574476319] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005736-00000C2B-3574617109] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005736-00000C2B-3575243292] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" [Source: 00000000-00005736-00000C2B-3575464415]42:T446,Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\windl.bat""" (UID: 00000000-00003476) Spawned process "taskkill.exe" with commandline "taskkill /f /im explorer.exe" (UID: 00000000-00007536) Spawned process "taskkill.exe" with commandline "taskkill /f /im taskmgr.exe" (UID: 00000000-00000516) Spawned process "taskkill.exe" with commandline "taskkill /f /im regedit.exe" (UID: 00000000-00007628) Spawned process "taskkill.exe" with commandline "taskkill /f /im ProcessHacker.exe" (UID: 00000000-00004576) Spawned process "net.exe" with commandline "net user qDbEwJe URNEXT" (UID: 00000000-00004960) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 user qDbEwJe URNEXT" (UID: 00000000-00008152) Spawned process "WMIC.exe" with commandline "wmic useraccount where name='qDbEwJe' set FullName='UR NEXT'" (UID: 00000000-00000376) Spawned process "WMIC.exe" with commandline "wmic useraccount where name='qDbEwJe' rename 'UR NEXT'" (UID: 00000000-00001076) Spawned process "shutdown.exe" with commandline "shutdown /f /r /t 0" (UID: 00000000-00004384)43:T446,Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\windl.bat""" (UID: 00000000-00003476) Spawned process "taskkill.exe" with commandline "taskkill /f /im explorer.exe" (UID: 00000000-00007536) Spawned process "taskkill.exe" with commandline "taskkill /f /im taskmgr.exe" (UID: 00000000-00000516) Spawned process "taskkill.exe" with commandline "taskkill /f /im regedit.exe" (UID: 00000000-00007628) Spawned process "taskkill.exe" with commandline "taskkill /f /im ProcessHacker.exe" (UID: 00000000-00004576) Spawned process "net.exe" with commandline "net user qDbEwJe URNEXT" (UID: 00000000-00004960) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 user qDbEwJe URNEXT" (UID: 00000000-00008152) Spawned process "WMIC.exe" with commandline "wmic useraccount where name='qDbEwJe' set FullName='UR NEXT'" (UID: 00000000-00000376) Spawned process "WMIC.exe" with commandline "wmic useraccount where name='qDbEwJe' rename 'UR NEXT'" (UID: 00000000-00001076) Spawned process "shutdown.exe" with commandline "shutdown /f /r /t 0" (UID: 00000000-00004384)44:T63b,"000.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\EVR"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINSAT"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MEDIA FOUNDATION\SCHEMEHANDLERS\FILE:"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS MEDIA FOUNDATION\SCHEMEHANDLERS\FILE:"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKCU\MEDIAFOUNDATION\MEDIASOURCES\DONOTUSE"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\MEDIAFOUNDATION\MEDIASOURCES\DONOTUSE"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\TREATAS"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\TREATAS"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\INPROCSERVER32"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\INPROCSERVER32"; Key: ""; Value: "") "000.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\INPROCHANDLER32"; Key: ""; Value: "")45:T5d1,"000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINSAT"; Key: "VIDEOMEMORYBANDWIDTH"; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}"; Key: ""; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\INPROCSERVER32"; Key: ""; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{477EC299-1421-4BDD-971F-7CCB933F21AD}"; Key: "APPID"; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{271C3902-6095-4C45-A22F-20091816EE9E}"; Key: ""; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{271C3902-6095-4C45-A22F-20091816EE9E}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{271C3902-6095-4C45-A22F-20091816EE9E}\INPROCSERVER32"; Key: ""; Value: "") "000.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{271C3902-6095-4C45-A22F-20091816EE9E}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")46:T441,"000.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "000.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "000.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "000.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "000.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "000.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "000.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "000.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"47:T93d,"000.exe" trying to access non-existent file "C:\FLTLIB.DLL" "000.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "000.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "000.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "000.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "000.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "000.exe" trying to access non-existent file "C:\AXINTEROP.WMPLIB.DLL" "000.exe" trying to access non-existent file "C:\INTEROP.WMPLIB.DLL" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL"48:T572,"000.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "000.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "000.exe" trying to access non-existent file "C:\000.EXE.CONFIG" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "000.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "000.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\000.EXE.LOG" "000.exe" trying to access non-existent file "C:\000.exe.config" "000.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\000" "000.exe" trying to access non-existent file "C:\000.INI" "000.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "000.exe" trying to access non-existent file "C:\000.EXE.LOCAL" "000.exe" trying to access non-existent file "C:\000.exe.Local\" "000.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\AXINTEROP.WMPLIB" "000.exe" trying to access non-existent file "C:\AXINTEROP.WMPLIB.INI" "000.exe" trying to access non-existent file "C:\AxInterop.WMPLib.INI" "000.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\INTEROP.WMPLIB"49:T13b5,Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM client cannot process the request. The body response is not a valid connect request response." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") file/memory contains long string with (Indicator: " shutdown "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "wsastartup"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "You have to connect to this printer before you can print on it. Do you want to connect to this printer and then print the selected document?" (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "Unable to connect Access denied, unable to connect.Printer not found on server, unable to connect" (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The printer is offline. mWindows could not connect to your printer. Please check the connection between the computer and the printer. bThe printer is not responding. Please check the connection between your computer and the printer." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The activation server reported that the computer could not connect to the activation server." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "G /S system Specifies the remote system to connect to." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "7Parameter %1 must not contain embedded null characters.!Find an app in the Windows Store.oYou need to install an app first. Install a people or contacts app so you can connect with the people you know." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "You can only send from apps." (Indicator: " send "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "send to a device right now.$To print content, connect a printer."To play content connect a device.HThe selected content is protected and can" (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp"), Found reference to API "To project connect a display." (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp"), Found reference to API "Install:This app is too big to download using a metered connection)Connect to another network and try again."Find another network to connect to\%1!s! can" (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "Unable to read system shutdown configuration information from the registry." (Indicator: " shutdown "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "Cannot connect to WinSAT" (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "Failed to apply CSC suspend policy. Cannot connect to CSC service.%n DETAIL - %1" (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "Windows Connect Now" (Indicator: " connect "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "restart or shutdown to service hardware on the system." (Indicator: " shutdown "; Source: "00000000-00004384.00000000.295990.A1B90000.00000004.mdmp") Found reference to API "restart or shutdown to begin or complete hardware installation." (Indicator: " shutdown "; Source: "00000000-00004384.00000000.295990.A1B90000.00000004.mdmp") Found reference to API "APPDATA=A restart or shutdown to change the operating system configuration." (Indicator: " shutdown "; Source: "00000000-00004384.00000000.295990.A1B90000.00000004.mdmp")4a:T684,"0.0.0.0" "17.0.0.0" "11.0.0.0" "1.0.0.0" "192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" "4.0.0.0"4b:T1b06,Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = '" - Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005736.00000000.292579.322B2000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005736.00000000.292579.58950000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json12/13" - Source: "00000000-00005736.00000000.292579.5A900000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,012/13" - Source: "00000000-00005736.00000000.292579.5A900000.00000002.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\000.exe.configfile:///c:/000.exec:/000.exec:\000.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.5.2versionv4.5.24.5.20123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\qdbewje\appdata\roaming\microsoft\clr" - Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp") Found URL "http://ns.adobe.com/xap/1.0/g/" - Source: "00000000-00005736.00000000.292579.75000000.00000004.mdmp") Found URL "http://ns.adobe.1.0/mm/" - Source: "00000000-00005736.00000000.292579.75000000.00000004.mdmp") Found URL "http://www.techsmimp/tscdmth.com/www.techsmith.com/xmp/t1.0/styp" - Source: "00000000-00005736.00000000.292579.75000000.00000004.mdmp") Found URL "http://ns.adobe.com/exif/1.:dc=" - Source: "00000000-00005736.00000000.292579.75000000.00000004.mdmp") Found URL "http://purl.org/dc/elements/1.1/" - Source: "00000000-00005736.00000000.292579.75000000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005736.00000000.292579.75000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005736.00000001.294500.58950000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\000.exe.configfile:///c:/000.exec:/000.exec:\000.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.5.2versionv4.5.24.5.20123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\qdbewje\appdata\roaming\microsoft\clr" - Source: "00000000-00005736.00000001.294500.5A920000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005736.00000001.294500.5A920000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005736.00000001.294500.5A920000.00000004.mdmp") Found URL "http://ns.adobe.mp/tscdmth.comf=" - Source: "00000000-00005736.00000001.294500.75000000.00000004.mdmp") Found URL "http://ns.adobe.com/exif/1." - Source: "00000000-00005736.00000001.294500.75000000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005736.00000001.294500.75000000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005736.00000001.294500.7A112000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005736.00000002.296420.58950000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json12/13" - Source: "00000000-00005736.00000002.296420.5A900000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,012/13" - Source: "00000000-00005736.00000002.296420.5A900000.00000002.mdmp")4d:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp")4e:T13cc,Found string "KERBEROS:" (Indicator: "kerberos"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found string "CoSetProxyBlanket(-, RPC_C_AUTHN_GSS_KERBEROS,RPC_C_AUTHZ_NONE, %s, %d, %d, -, EOAC_NONE)" (Indicator: "kerberos"; Source: "00000000-00000376.00000000.293518.37CBE000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00001076.00000000.293856.47B60000.00000002.mdmp")4f:T5a5,Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp") Found string "\" (Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00005736.00000000.292579.74570000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00005736.00000000.292579.74570000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005736-00000C2C-3573214800\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"rniw.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"000.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005736-00000C2C-3574244085\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005736-00000C2C-3573616746\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005736-00000C2C-3572386721\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005736-00000C2C-3572387235\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in file \"000.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"000.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005736)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000376)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001076)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"000.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"000.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"000.exe\" called \"GetWindowTextW\" (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"000.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"000.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000072006f000000000000000000000000004500000000004600000000000000010000006f002000000036003400c07997584202000000000000010000000100000039005c000000000000000000400000005c006d0090fc97584202000000000000140000000a0000006600690000000000 (UID: 00000000-00005736)\n \"000.exe\" called \"GetVersionExA\" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"000.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005736)\n \"000.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM MSFT_CliAlias\" (Indicator: \"select * from \"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliAlias\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found string \"SELECT * FROM MSFT_CliTranslateTable\" (Indicator: \"select * from \"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found string \"IWbemServices::ExecQuery(L\"WQL\",L\"SELECT * FROM MSFT_CliTranslateTable\",WBEM_FLAG_FORWARD_ONLY|WBEM_FLAG_RETURN_IMMEDIATELY,NULL, -)\" (Indicator: \"select * from \"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found string \"SELECT * FROM Win32_UserAccount WHERE name='qDbEwJe'\" (Indicator: \"select * from \"; Source: \"00000000-00000376.00000000.293518.446A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"000.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"net user %username% URNEXT\" (Indicator: \"%username%\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")\n Found string \"wmic useraccount where name='%username%' set FullName='UR NEXT'\" (Indicator: \"%username%\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")\n Found string \"wmic useraccount where name='%username%' rename 'UR NEXT'\" (Indicator: \"%username%\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_UserAccount WHERE name='qDbEwJe'\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"000.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"000.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"000.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"rniw.exe\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"000.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\windl.bat\"\" - (UID: 00000000-00005736)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im explorer.exe\" - (UID: 00000000-00003476)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im taskmgr.exe\" - (UID: 00000000-00003476)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im regedit.exe\" - (UID: 00000000-00003476)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /im ProcessHacker.exe\" - (UID: 00000000-00003476)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"net user qDbEwJe URNEXT\" - (UID: 00000000-00003476)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic useraccount where name='qDbEwJe' set FullName='UR NEXT'\" - (UID: 00000000-00003476)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic useraccount where name='qDbEwJe' rename 'UR NEXT'\" - (UID: 00000000-00003476)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"shutdown /f /r /t 0\" - (UID: 00000000-00003476)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"000.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM MSFT_CliAlias\" (Source: 00000000-00000376.00000000.293518.37CBE000.00000002.mdmp, Indicator: \"select * from msft_clialias\")\n \"SELECT * FROM MSFT_CliTranslateTable\" (Source: 00000000-00000376.00000000.293518.37CBE000.00000002.mdmp, Indicator: \"select * from msft_clitranslatetable\")\n \"SELECT * FROM\" (Source: 00000000-00000376.00000000.293518.37CBE000.00000002.mdmp, Indicator: \"select * from\")\n \"SELECT * FROM Win32_UserAccount WHERE name='qDbEwJe'\" (Source: 00000000-00000376.00000000.293518.446A0000.00000004.mdmp, Indicator: \"select * from win32_useraccount where name='qdbewje'\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"000.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"000.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"Icmp6CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: rniw.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"000.exe\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"000.exe\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \":\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Users\\qDbEwJe\\AppData\\Local\\Temp\\windl.bat\"\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005736.00000000.292579.58950000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Users\\qDbEwJe\\AppData\\Local\\Temp\\windl.bat\"\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005736.00000000.292579.58950000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"000.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"CreateThreadId\" (Indicator: \"CreateThread\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"000.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"000.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"000.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"000.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"copy %temp%\\rniw.exe \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\rniw.exe\"\" (Indicator: \"copy %temp%\\rniw.exe \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\rniw.exe\"\") in Source: 00000000-00005736.00000000.292579.5A920000.00000004.mdmp\n 00000000-00005736.00000001.294500.5A920000.00000004.mdmp\n 00000000-00005736.00000002.296420.5A920000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$39","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Detected file retrieval based on search patterns","description":"Process \"WMIC.exe\" with commandline \"wmic useraccount where name='qDbEwJe' set FullName='UR NEXT'\" (UID: 00000000-00000376)\n Process \"WMIC.exe\" with commandline \"wmic useraccount where name='qDbEwJe' rename 'UR NEXT'\" (UID: 00000000-00001076)","origin":"Monitored Target","mitre_attack_id":"T1083","id":"target-424","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"000.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"000.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"%TEMP%\\\\windl.bat\"\"\" (UID: 00000000-00003476)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"000.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Interop.WMPLib.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"AxInterop.WMPLib.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"000.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 179A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"000.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 322C0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"000.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 45C70000\n \"000.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 44ED0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 45C70000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 45C70000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 44ED0000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 44ED0000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 45C70000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 44ED0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 45C70000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 44ED0000\n \"shutdown.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 45C70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"000.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 1FF30000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"000.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46890000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46890000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46890000\n \"net.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46890000\n \"net1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46890000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46890000\n \"shutdown.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 46890000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c71346f97f0000@ntdll.dll\"\n \"220023000000000018c71346f97f0000@ntdll.dll\"\n \"19001a007600000040c71346f97f0000@ntdll.dll\"\n \"\"#v@ntdll.dll\", \"19001a006b00000040c71346f97f0000@ntdll.dll\", \"\"#k@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"000.exe\" was detected as \".NET\" and name: \"Library\"\n \"000.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Interop.WMPLib.dll\" was detected as \".NET\" and name: \"Library\"\n \"Interop.WMPLib.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"rniw.exe\" was detected as \".NET\" and name: \"Library\"\n \"rniw.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"AxInterop.WMPLib.dll\" was detected as \".NET\" and name: \"Library\"\n \"AxInterop.WMPLib.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"000.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Interop.WMPLib.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"AxInterop.WMPLib.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"000.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"000.exe\" has an executable section named \".text\"\n \"Interop.WMPLib.dll\" has an executable section named \".text\"\n \"rniw.exe\" has an executable section named \".code\"\n \"rniw.exe\" has an executable section named \".text\"\n \"AxInterop.WMPLib.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"rniw.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x6a9600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x6a9488\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3f","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00003476) was launched with new environment variables: \"USERDNSDOMAIN=\"i8va9hWskJVwsdH\"\"\n Process \"cmd.exe\" (UID: 00000000-00003476) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"taskkill.exe\" (UID: 00000000-00007536) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"shutdown.exe\" (UID: 00000000-00004384) was launched with new environment variables: \"cr=\"400\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$40","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"cmd.exe\" opens a file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\one.rtf (UID: 00000000-00003476)\n \"cmd.exe\" opens a file C:\\Users\\%OSUSER%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.RTF (UID: 00000000-00003476)\n \"cmd.exe\" opens a file C:\\Users\\%OSUSER%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtf (UID: 00000000-00003476)\n \"cmd.exe\" opens a file %TEMP%\\one.rtf (UID: 00000000-00003476)\n \"cmd.exe\" opens a file %USERPROFILE%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.RTF (UID: 00000000-00003476)\n \"cmd.exe\" opens a file %USERPROFILE%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtf (UID: 00000000-00003476)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Interop.WMPLib.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"rniw.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AxInterop.WMPLib.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Write document files in a temp directory","description":"\"000.exe\" writes a file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\one.rtf (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1119","relevance":2,"id":"api-249","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"000.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\street.mp4\"\n \"000.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\windl.bat\"\n \"000.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\one.rtf\"\n \"000.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\text.txt\"\n \"000.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\icon.ico\"\n \"000.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rniw.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found string \"<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found string \"Outlook Attachment\" (Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found string \"Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator.\" (Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"000.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"000.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Interop.WMPLib.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\Interop.WMPLib.dll]- [targetUID: 00000000-00005736]\n \"rniw.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\rniw.exe]- [targetUID: 00000000-00005736]\n \"AxInterop.WMPLib.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\AxInterop.WMPLib.dll]- [targetUID: 00000000-00005736]\n \"one.rtf\" has type \"Rich Text Format data version 1 ANSI code page 1252 default language ID 1033\"- Location: [%TEMP%\\one.rtf]- [targetUID: 00000000-00005736]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"Interop.WMPLib.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\Interop.WMPLib.dll]- [targetUID: 00000000-00005736]\n \"AxInterop.WMPLib.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\AxInterop.WMPLib.dll]- [targetUID: 00000000-00005736]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"000.exe\" queries basic process information of the \"C:\\000.exe\" (UID: 5736)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"000.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005736)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"000.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"000.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"000.exe\" trying to touch file \"C:\\000.exe\"\n \"000.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"000.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"000.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"000.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"000.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"000.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"000.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"000.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"cmd.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\rniw.exe\"\n \"cmd.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\rniw.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"000.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Adobe Reader XI.lnk\"\n \"000.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Google Chrome.lnk\"\n \"000.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Microsoft Edge.lnk\"\n \"000.exe\" trying to access LNK file \"%PUBLIC%\\Desktop\\Adobe Reader XI.lnk\"\n \"000.exe\" trying to access LNK file \"%PUBLIC%\\Desktop\\Google Chrome.lnk\"\n \"000.exe\" trying to access LNK file \"%PUBLIC%\\Desktop\\Microsoft Edge.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"000.exe\" writes file \"c:\\axinterop.wmplib.dll\"\n \"000.exe\" writes file \"c:\\interop.wmplib.dll\"\n \"000.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\street.mp4\"\n \"000.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\windl.bat\"\n \"000.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\one.rtf\"\n \"000.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\text.txt\"\n \"000.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\icon.ico\"\n \"000.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rniw.exe\"\n \"000.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\media player\\currentdatabase_400.wmdb\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0,\" (Indicator: \"ping \"; Source: \"00000000-00001076.00000000.293856.45580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001076.00000000.293856.47B60000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00008152\"\n YARA signature to detect medium entropy file process \"00000000-00005736\"\n YARA signature to detect medium entropy file file \"rniw.exe\"\n YARA signature to detect medium entropy file process \"00000000-00001076\"\n YARA signature to detect medium entropy file process \"00000000-00000376\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"rniw.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"\n YARA signature matched on embedded PE in file \"rniw.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00001076\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"Flags = \"Assertion\n UnmanagedCode\n Execution\n ControlThread\n ControlEvidence\n ControlPolicy\n ControlAppDomain\n SerializationFormatter\n ControlDomainPolicy\n ControlPrincipal\n RemotingConfiguration\n Infrastructure\n BindingRedirects\" />\" (Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE74F68C36AEC846D40C2869A883ED]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005736.00000000.292579.58950000.00000004.mdmp, 00000000-00005736.00000001.294500.58950000.00000004.mdmp, 00000000-00005736.00000002.296420.58950000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"9790,5180,3024,,RtlGetVersion,NTDLL.dll,\"01:16:07.437\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005736.00000000.292579.58950000.00000004.mdmp, 00000000-00005736.00000001.294500.58950000.00000004.mdmp, 00000000-00005736.00000002.296420.58950000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: rniw.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"000.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"000.exe\" tries to directly access volume data \"A:\"\n \"000.exe\" tries to directly access volume data \"B:\"\n \"000.exe\" tries to directly access volume data \"D:\"\n \"000.exe\" tries to directly access volume data \"E:\"\n \"000.exe\" tries to directly access volume data \"F:\"\n \"000.exe\" tries to directly access volume data \"G:\"\n \"000.exe\" tries to directly access volume data \"H:\"\n \"000.exe\" tries to directly access volume data \"I:\"\n \"000.exe\" tries to directly access volume data \"J:\"\n \"000.exe\" tries to directly access volume data \"K:\"\n \"000.exe\" tries to directly access volume data \"L:\"\n \"000.exe\" tries to directly access volume data \"M:\"\n \"000.exe\" tries to directly access volume data \"N:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"000.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"net1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"shutdown.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00000376)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00001076)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"000.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00001076.00000000.293856.47B60000.00000002.mdmp]\n Observed string: \"tasklist.exe.mui\" [Source: 00000000-00001076.00000000.293856.47B60000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"000.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"000.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"000.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE SchemaOnly\" (Indicator: \"where \"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"000.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"000.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"000.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$55","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"000.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_UserAccount WHERE name='qDbEwJe'\" (Indicator: \" Win32_UserAccount\"; Source: \"00000000-00000376.00000000.293518.446A0000.00000004.mdmp\")\n Found string \"from Win32_UserAccount\" (Indicator: \" Win32_UserAccount\"; Source: \"00000000-00001076.00000000.293856.45580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005736-00000C2C-3571976649\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005736-00000C2C-3573190445\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$57","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"Found string \"net user %username% URNEXT\" (Indicator: \"net user \"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"000.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"$59","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"000.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000376.00000000.293518.37CBE000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005736.00000000.292579.322B2000.00000002.mdmp, 00000000-00005736.00000000.292579.5A920000.00000004.mdmp, 00000000-00005736.00000001.294500.5A920000.00000004.mdmp, 00000000-00005736.00000002.296420.5A920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"000.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"1747F4E19E6CDC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"000.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"NtInitiatePowerAction\" (Indicator: \"InitiatePowerAction\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00004384.00000000.295990.75B55000.00000002.mdmp\")\n Found reference to API \"2877420365,3768,3203,,InitiateSystemShutdownExW,advapi32.dll,\"01:17:01.343\",RX=0,PX=0\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00004384.00000000.295990.A1B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"rniw.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\rniw.exe]- [targetUID: 00000000-00005736]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Extract\" (Source: 000.exe, API is part of module: URLMON.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"000.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Interop.WMPLib.dll\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"rniw.exe\" was detected as \"PureBasic 4.x -> Neil Hodgson\"\n \"AxInterop.WMPLib.dll\" was detected as \"Microsoft visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"WWAHost.exe.mui\" (Indicator: \"wwahost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"000.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"000.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5736)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"%WINDIR%\\system32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00003476-00000C47-2724101995\")\n Found string \"%WINDIR%\\System32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00003476-00000BC0-3576824926\")\n Found string \"taskkill /f /im taskmgr.exe\" (Indicator: \"taskmgr.exe\"; Source: \"00000000-00003476-00000C47-5437106164\")\n Found string \"taskkill /f /im regedit.exe\" (Indicator: \"regedit.exe\"; Source: \"00000000-00003476-00000C47-8074486304\")\n Found string \"taskkill /f /im ProcessHacker.exe\" (Indicator: \"processhacker.exe\"; Source: \"00000000-00003476-00000C47-9092821761\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"000.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"000.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Interop.WMPLib.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\Interop.WMPLib.dll]- [targetUID: 00000000-00005736]\n \"rniw.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\rniw.exe]- [targetUID: 00000000-00005736]\n \"AxInterop.WMPLib.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [C:\\AxInterop.WMPLib.dll]- [targetUID: 00000000-00005736]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5d","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex(System.Int32) at 27f84a42d581880d149185494ab621e1-6000006-Form1~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"000.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPER\"; Value: \"000000\")","origin":"Registry Access","mitre_attack_id":"T1491","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"000.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"000.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"000.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Media Player\\WMPFOLDERS.WMDB\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetProcAddress\n GetTempFileNameA\n WriteFile\n DeleteFileA\n CreateFileA\n FindResourceA\n GetSystemDirectoryA\n LoadLibraryA\n GetTempPathA\n GetVersionExA\n TerminateProcess\n CreateDirectoryA\n GetFileSize\n Sleep\n GetCommandLineA\n GetNativeSystemInfo\n GetModuleFileNameA\n ShellExecuteExA\n GetWindowThreadProcessId","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"000.exe\" claims program is from Thu May 31 16:23:56 2085","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"rniw.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable for MS Windows 6.00 (GUI)\n Intel i386 Mono/.Net assembly\n 3 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im explorer.exe\" (UID: 00000000-00007536)\n Process \"taskkill.exe\" with commandline \"taskkill /f /im taskmgr.exe\" (UID: 00000000-00000516)\n Process \"taskkill.exe\" with commandline \"taskkill /f /im regedit.exe\" (UID: 00000000-00007628)\n Process \"taskkill.exe\" with commandline \"taskkill /f /im ProcessHacker.exe\" (UID: 00000000-00004576)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Environment Awareness","name":"Maps local system accounts","description":"Process \"net.exe\" with commandline \"net user qDbEwJe URNEXT\" (UID: 00000000-00004960)\n Process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 user qDbEwJe URNEXT\" (UID: 00000000-00008152)","origin":"Monitored Target","mitre_attack_id":"T1087.001","relevance":7,"id":"target-124","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Environment Awareness","name":"Uses WMIC to find system user account","description":"Process \"WMIC.exe\" with commandline \"wmic useraccount where name='qDbEwJe' set FullName='UR NEXT'\" (UID: 00000000-00000376)\n Process \"WMIC.exe\" with commandline \"wmic useraccount where name='qDbEwJe' rename 'UR NEXT'\" (UID: 00000000-00001076)","origin":"Monitored Target","mitre_attack_id":"T1087.001","relevance":7,"id":"target-149","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Disables Windows Registry Editor (regedit)","description":"\"000.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"DISABLEREGISTRYTOOLS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-2","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Disables Windows Task Manager (taskmgr)","description":"\"000.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"DISABLETASKMGR\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":9,"id":"registry-3","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"System Destruction","name":"Shutdown/reboot a Windows system","description":"Process \"shutdown.exe\" with commandline \"shutdown /f /r /t 0\" (UID: 00000000-00004384)","origin":"Monitored Target","mitre_attack_id":"T1529","relevance":10,"id":"target-120","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"000.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"System Security","name":"Terminates system processes","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im taskmgr.exe\" (UID: 00000000-00000516)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-39","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$5f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"000.exe\" touched \"K:\"\n \"000.exe\" touched \"L:\"\n \"000.exe\" touched \"M:\"\n \"000.exe\" touched \"N:\"\n \"000.exe\" touched \"O:\"\n \"000.exe\" touched \"P:\"\n \"000.exe\" touched \"Q:\"\n \"000.exe\" touched \"R:\"\n \"000.exe\" touched \"S:\"\n \"000.exe\" touched \"T:\"\n \"000.exe\" touched \"U:\"\n \"000.exe\" touched \"V:\"\n \"000.exe\" touched \"W:\"\n \"000.exe\" touched \"X:\"\n \"000.exe\" touched \"Y:\"","origin":"API Call","mitre_attack_id":"T1120","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"Changes the desktop background picture"},{"detail":"Shutdown/reboot a Windows system"}],"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"},{"detail":"Tries to modify winlogon helper dll registry key to achieve persistence"}],"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads system information using WMIC"}],"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Tries to access unusual system drive letters"},{"detail":"Maps local system accounts"}],"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":44,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":83,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["neshta","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"693dac105cd29bf148082aaa","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"000.exe","analysis_start_time":"2025-12-13T18:10:25+00:00","indicators_count":{"informative":211,"suspicious":48,"malicious":14},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"681b4a6bf56768f5db07e654","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"ERROR","error_type":"Internal error has occurred (Code: DC:DETONATION-ERROR)","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2025-05-07T11:56:27+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"681b444e47b76a183b0716f8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"ERROR","error_type":"Internal error has occurred (Code: DC:DETONATION-ERROR)","verdict":"undetected","submit_name":"000.exe","analysis_start_time":"2025-05-07T11:30:22+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}],"processes":[{"pid":5736,"ppid":0,"name":"000.exe","command_line":"","sha256":"5eed2b5832483191e67f2ffbdcf349a6256039a8a7f934fb6bb9188873f8a73b","normalized_path":"C:\\000.exe","uid":"00000000-00005736","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3476,"ppid":5736,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\windl.bat\"\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005736","uid":"00000000-00003476"},{"pid":7536,"ppid":3476,"name":"taskkill.exe","command_line":"taskkill /f /im explorer.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00003476","uid":"00000000-00007536"},{"pid":516,"ppid":3476,"name":"taskkill.exe","command_line":"taskkill /f /im taskmgr.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00003476","uid":"00000000-00000516"},{"pid":7628,"ppid":3476,"name":"taskkill.exe","command_line":"taskkill /f /im regedit.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00003476","uid":"00000000-00007628"},{"pid":4576,"ppid":3476,"name":"taskkill.exe","command_line":"taskkill /f /im ProcessHacker.exe","sha256":"d3723916e8f8ab3ed3c7c261d33111b0124f47a901ecffd744513cb4f4890577","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00003476","uid":"00000000-00004576"},{"pid":4960,"ppid":3476,"name":"net.exe","command_line":"net user qDbEwJe URNEXT","sha256":"8267ee144d1bf557bc2a8a46335242bf0c52b919442e03401f69028726116615","normalized_path":"%WINDIR%\\system32\\net.exe","parent_uid":"00000000-00003476","uid":"00000000-00004960"},{"pid":8152,"ppid":4960,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 user qDbEwJe URNEXT","sha256":"325158c8f4b250fe7438c88c8bac47aedebece852aac5926308ca7dc29d7e31c","normalized_path":"%WINDIR%\\system32\\net1.exe","parent_uid":"00000000-00004960","uid":"00000000-00008152"},{"pid":376,"ppid":3476,"name":"WMIC.exe","command_line":"wmic useraccount where name='qDbEwJe' set FullName='UR NEXT'","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00003476","uid":"00000000-00000376"},{"pid":1076,"ppid":3476,"name":"WMIC.exe","command_line":"wmic useraccount where name='qDbEwJe' rename 'UR NEXT'","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","parent_uid":"00000000-00003476","uid":"00000000-00001076"},{"pid":4384,"ppid":3476,"name":"shutdown.exe","command_line":"shutdown /f /r /t 0","sha256":"53f8257aac5c4fe933769da955ffc5e3d6222e09002c3aa8c7446621e001d8bd","normalized_path":"%WINDIR%\\system32\\shutdown.exe","parent_uid":"00000000-00003476","uid":"00000000-00004384"}],"all_imported_dlls":["GdiPlus.dll","wbemprox.dll","wbemsvc.dll","System.Core.ni.dll","Windows.Media.dll","apphelp.dll","gdi32.dll","profapi.dll","WMASF.DLL","wmpeffects.dll","d3d9.dll","cldapi.dll","imagehlp.dll","mscoree.dll","win32u.dll","msvcp_win.dll","userenv.dll","Windows.StateRepositoryPS.dll","fastprox.dll","version.dll","cfgmgr32.dll","d3d10warp.dll","ntdll.dll","mscorlib.ni.dll","System.Windows.Forms.ni.dll","rsaenh.dll","cryptbase.dll","user32.dll","System.ni.dll","winmmbase.dll","imm32.dll","comctl32.dll","wmp.dll","IPHLPAPI.DLL","nsi.dll","rpcrt4.dll","clr.dll","ucrtbase_clr0400.dll","dwmapi.dll","p1h9dL1e.dll","mf.dll","winsta.dll","msasn1.dll","samlib.dll","powrprof.dll","propsys.dll","amsi.dll","dxva2.dll","msvcr90.dll","uxtheme.dll","SHCore.dll","msdmo.dll","ResourcePolicyClient.dll","mpr.dll","ws2_32.dll","mfplat.dll","devobj.dll","mftranscode.dll","urlmon.dll","netutils.dll","samcli.dll","KernelBase.dll","System.Drawing.ni.dll","dsrole.dll","kernel32.dll","vcruntime140_clr0400.dll","System.Xml.ni.dll","RTWorkQ.dll","ksuser.dll","bcrypt.dll","jscript.dll","mfcore.dll","sspicli.dll","logoncli.dll","fltLib.dll","ucrtbase.dll","mfmp4srcsnk.dll","srvcli.dll","shell32.dll","evr.dll","wkscli.dll","wininet.dll","MpOAV.dll","mfps.dll","CoreUIComponents.dll","ntmarta.dll","framedynos.dll","WMVCORE.DLL","combase.dll","DWrite.dll","avrt.dll","TextInputFramework.dll","bcryptprimitives.dll","mfperfhelper.dll","crypt32.dll","winnsi.dll","mscoreei.dll","msvcrt.dll","sechost.dll","COLORCNV.DLL","CompPkgSup.dll","winhttp.dll","cmdext.dll","msxml6.dll","MSOXMLMF.DLL","oleaut32.dll","dcomp.dll","iertutil.dll","dbghelp.dll","shlwapi.dll","cryptsp.dll","System.Configuration.ni.dll","clbcatq.dll","wmploc.DLL","sxs.dll","mfasfsrcsnk.dll","kernel.appcore.dll","MMDevAPI.dll","atlthunk.dll","mfsensorgroup.dll","OnDemandConnRouteHelper.dll","msIso.dll","gdi32full.dll","clrjit.dll","windows.storage.dll","WinTypes.dll","msmpeg2vdec.dll","winmm.dll","mswsock.dll","msctf.dll","ole32.dll","CoreMessaging.dll","wbemcomn.dll","VxSSL64.dll","advapi32.dll","psapi.dll","aepic.dll","provsvc.dll","shutdownext.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"rniw.exe","sha256":"70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"one.rtf","sha256":"ef2fd3a239aa65c7c9cb204e5ae003ddd6a80d439c59f813e76d4e68987a259a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"AxInterop.WMPLib.dll","sha256":"910e370790c67a0882e352134744fce3d6fd990208a6332a6aef28cb88198491","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Interop.WMPLib.dll","sha256":"2251d8074037580989b076d13b9297d452224b95ce0f78209e924b5b3e7b5b7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"C:\\AxInterop.WMPLib.dll","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"C:\\Interop.WMPLib.dll","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%TEMP%\\street.mp4","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%TEMP%\\windl.bat","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%TEMP%\\one.rtf","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%TEMP%\\text.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%TEMP%\\icon.ico","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%TEMP%\\rniw.exe","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Media Player\\CurrentDatabase_400.wmdb","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\rniw.exe","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N0XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N2XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N3XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N4XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N5XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N6XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N7XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N8XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N9XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N10XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N11XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N12XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N13XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N14XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N15XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N16XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N17XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N18XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N19XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N20XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N21XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N22XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N23XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N24XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N25XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N26XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N27XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\OPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENMEOPENME.rtf","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N28XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N29XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N30XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N31XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N32XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N33XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N34XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N35XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N36XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N37XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N38XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N39XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N40XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N41XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N42XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N43XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N44XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N45XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N46XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N47XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N48XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N49XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N50XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N51XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N52XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N53XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N54XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N55XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N56XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N57XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N58XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N59XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N60XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N61XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N62XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N63XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"%USERPROFILE%\\Desktop\\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N64XT.txt","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\MEDIAPLAYER\\PREFERENCES\\\\","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\MEDIAPLAYER\\PREFERENCES\\\\","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\USERDEFINED\\","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Local\\SM0:5736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Local\\SM0:5736:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"SM0:5736:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"WindowsMediaStoreMutex","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"SM0:5736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:14","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5736:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WindowsMediaStoreMutex","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{815ead30-0000-0000-0000-501f00000000}_720896_58657","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{815ead30-0000-0000-0000-501f00000000}_720896_58657:x","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{815ead30-0000-0000-0000-501f00000000}_720896_58657:splk:5736","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:1","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:2","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:3","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:4","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:5","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:6","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:7","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:8","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:9","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:10","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:11","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:12","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\{afd84eff-2894-4d9c-8559-68a65b80f8d8}:sqlce_se_lck:13","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5736:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"SM0:376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"SM0:376:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Local\\SM0:376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:376:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"Local\\SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"SM0:1076:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1076:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"693dac105cd29bf148082aaa"}]}]}},"report_ids":{"sandbox_job_ids":["693dac105cd29bf148082aaa"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Marsilia.Generic Sample 5eed2b583248… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5eed2b583248…. Malware family: Marsilia.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5eed2b5832483191e67f2ffbdcf349a6256039a8a7f934fb6bb9188873f8a73b"}],["$","meta","4",{"property":"og:title","content":"Malicious Marsilia.Generic Sample 5eed2b583248… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5eed2b583248…. Malware family: Marsilia.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5eed2b5832483191e67f2ffbdcf349a6256039a8a7f934fb6bb9188873f8a73b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Marsilia.Generic Sample 5eed2b583248… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5eed2b583248…. Malware family: Marsilia.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L60","11",{}]]