26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 74:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6092579a9979… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6092579a9979…. Malware family: Trojan.Generic. Threat score 100/100. 7/24 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706"],"about":{"@type":"SoftwareApplication","name":"a67e34baacfca98f323981d3b0087f3b.exe","applicationCategory":["peexe","autoit","executable"],"identifier":"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":7,"total":24},"behavioralIndicators":{"malicious":11,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2efe,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")28:Ta9d,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5243392'}" (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5243328'}" (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5243344'}" (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadResource with parameter {'hModule': '1976827904', 'hResInfo': '3147248'}" (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5243360'}" (UID: 00000000-00005384) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635864'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635640'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635896'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635704'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635880'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635688'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635656'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635912'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '14811136', 'hResInfo': '15635672'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '90963969', 'hResInfo': '91090720'}" (UID: 00000000-00005856) "Dr.com" called "LoadResource with parameter {'hModule': '90963969', 'hResInfo': '91065872'}" (UID: 00000000-00005856) "ApolloPro.scr" called "LoadResource with parameter {'hModule': '393216', 'hResInfo': '1217944'}" (UID: 00000000-00000836) "ApolloPro.scr" called "LoadResource with parameter {'hModule': '393216', 'hResInfo': '1217720'}" (UID: 00000000-00000836) "ApolloPro.scr" called "LoadResource with parameter {'hModule': '393216', 'hResInfo': '1217976'}" (UID: 00000000-00000836) "ApolloPro.scr" called "LoadResource with parameter {'hModule': '393216', 'hResInfo': '1217784'}" (UID: 00000000-00000836)29:Td3e,file/memory contains long string with (Indicator: "RC2"; File: "Revenue") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "AesEngine" (Indicator: "Aes"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "k__BackingField" (Indicator: "Oid"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "get_Oid" (Indicator: "Oid"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "set_Oid" (Indicator: "Oid"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "SHA512CryptoServiceProvider" (Indicator: "SHA512"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found reference to "RC2Uhd++AAlspFmdwsf2xP9pRPJDlgWDQ2mJuPBHH/M8wNoeJNEkmvbpFjyq4BJ" (Indicator: "RC2"; Source: "00000000-00003312.00000002.86411.00C70000.00000004.mdmp") Found reference to "qoxg0YvDUeOfSAVV89wcnHZPIIfkqOidqx/5qXxeIylAeTiEchsm1Dt/rHm0vTq" (Indicator: "Oid"; Source: "00000000-00003312.00000002.86411.00C70000.00000004.mdmp")2a:T919,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PROPERTYBAG") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PROPERTYBAG") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_PROTOCOL_LOCKDOWN") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0")2b:T93f,"Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-2153215 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-4141465 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-7828232 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12128063 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12136818 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12145428 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12154092 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12162901 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12171310 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12179886 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12188815 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-12199892 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-13014602 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-13215043 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-13409293 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-17391744 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-20970370 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-94424252 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-95286687 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-95951116 [PID: 5856] "Dr.com" queried SystemProcessInformation at 00000000-00005856-00000105-163804714 [PID: 5856] "ApolloPro.scr" queried SystemProcessInformation at 00000000-00000836-00000105-2027504 [PID: 836] "ApolloPro.scr" queried SystemProcessInformation at 00000000-00000836-00000105-3635251 [PID: 836] "ApolloPro.scr" queried SystemProcessInformation at 00000000-00000836-00000105-7638218 [PID: 836] "ApolloPro.scr" queried SystemProcessInformation at 00000000-00000836-00000105-12509760 [PID: 836]2c:T12e4,"RegAsm.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "RegAsm.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}2d:T106e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-41-00E4A3F8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-41-00E4A3F8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-45-00E48E89 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-45-00E48E89 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-51-00E55CAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-51-00E55CAC Assembly shows XOR instruction xor eax dword ptr [00EE0D50h] in Stream UID: 00000000-00005856-59327-64-00E4A05B Assembly shows XOR instruction xor eax dword ptr [00EE0D50h] in Stream UID: 00000000-00005856-59327-68-00E4A016 Assembly shows XOR instruction xor eax dword ptr [00EE0D50h] in Stream UID: 00000000-00005856-59327-71-00E49FF7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-154-00E4DBA5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-154-00E4DBA5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-185-00E4B19D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-185-00E4B19D Assembly shows XOR instruction xor eax dword ptr [00EE0D50h] in Stream UID: 00000000-00005856-59327-326-00E54C14 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-454-00E5598B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-454-00E5598B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-464-00E5AEC3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-464-00E5AEC3 Assembly shows XOR instruction xor eax dword ptr [00EE0D50h] in Stream UID: 00000000-00005856-59327-465-00E54B20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-471-00E4F18E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-471-00E4F18E Assembly shows XOR instruction xor eax dword ptr [00EE0D50h] in Stream UID: 00000000-00005856-59327-488-00E54B96 Assembly shows XOR instruction xor eax dword ptr [00EE0D50h] in Stream UID: 00000000-00005856-59327-489-00E54BDF Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005856-59327-556-00E4CD51 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005856-59327-556-00E4CD51 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005856-59327-556-00E4CD51 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005856-59327-556-00E4CD51 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-745-00E45AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-745-00E45AF0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005856-59327-858-00E22BA9 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00005856-59327-891-00EA7F6B Assembly shows XOR instruction xor ebx 10h in Stream UID: 00000000-00005856-59327-894-00EA73A5 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005856-59327-901-00EA6BDB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-59327-1004-00E4E40A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-59327-1004-00E4E40A Assembly shows XOR instruction xor al byte ptr [ebp-02h] in Stream UID: 00000000-00005856-59327-1125-00E5807E Assembly shows XOR instruction xor byte ptr [ecx+edx+24h] al in Stream UID: 00000000-00005856-59327-1125-00E5807E Assembly shows XOR instruction xor eax 08h in Stream UID: 00000000-00005856-59327-1170-00E82CCE Assembly shows XOR instruction xor ecx 49656E69h in Stream UID: 00000000-00005856-59327-1249-00E4885B Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00005856-59327-1249-00E4885B Assembly shows XOR instruction xor eax 756E6547h in Stream UID: 00000000-00005856-59327-1249-00E4885B2e:T40c,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2f:T8b5d,Found XOR loop in file "Dr.com" at offset 209727; code bytes = 30d0 Found XOR loop in file "Dr.com" at offset 488439; code bytes = 30d0 Found XOR loop in file "Dr.com" at offset 624266; code bytes = 30d0 Found XOR loop in file "Dr.com" at offset 857601; code bytes = 30d0 Found XOR loop in file "Dr.com" at offset 872765; code bytes = 30d0 Found XOR loop in file "Dr.com" at offset 881695; code bytes = 30d0 Found XOR loop in file "Dr.com" at offset 884303; code bytes = 30d0 Found XOR loop in file "Dr.com" at offset 122211; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 243805; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 426397; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 426471; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 426655; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 426708; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 426737; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 546769; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 629178; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 635354; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 643061; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 643509; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 644085; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 644533; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 645285; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 645733; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 646309; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 646757; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 865511; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 874457; code bytes = 33c1 Found XOR loop in file "Dr.com" at offset 100479; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 606796; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 619146; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 861962; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 866398; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 869928; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 883204; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 884284; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 888180; code bytes = 8030 Found XOR loop in file "Dr.com" at offset 890356; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 61346; code bytes = 30d0 Found XOR loop in file "RegAsm.exe" at offset 13430; code bytes = 30040e Found XOR loop in file "RegAsm.exe" at offset 13460; code bytes = 30040e Found XOR loop in file "RegAsm.exe" at offset 10181; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 25425; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 26100; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 28453; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 44718; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 209727; code bytes = 30d0 Found XOR loop in file "ApolloPro.scr" at offset 488439; code bytes = 30d0 Found XOR loop in file "ApolloPro.scr" at offset 624266; code bytes = 30d0 Found XOR loop in file "ApolloPro.scr" at offset 857601; code bytes = 30d0 Found XOR loop in file "ApolloPro.scr" at offset 872765; code bytes = 30d0 Found XOR loop in file "ApolloPro.scr" at offset 881695; code bytes = 30d0 Found XOR loop in file "ApolloPro.scr" at offset 884303; code bytes = 30d0 Found XOR loop in file "ApolloPro.scr" at offset 122211; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 243805; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 426397; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 426471; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 426655; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 426708; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 426737; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 546769; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 629178; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 635354; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 643061; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 643509; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 644085; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 644533; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 645285; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 645733; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 646309; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 646757; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 865511; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 874457; code bytes = 33c1 Found XOR loop in file "ApolloPro.scr" at offset 100479; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 606796; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 619146; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 861962; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 866398; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 869928; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 883204; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 884284; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 888180; code bytes = 8030 Found XOR loop in file "ApolloPro.scr" at offset 890356; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 209727; code bytes = 30d0 Found XOR loop in file "Commissioner" at offset 488439; code bytes = 30d0 Found XOR loop in file "Commissioner" at offset 624266; code bytes = 30d0 Found XOR loop in file "Commissioner" at offset 857601; code bytes = 30d0 Found XOR loop in file "Commissioner" at offset 872765; code bytes = 30d0 Found XOR loop in file "Commissioner" at offset 881695; code bytes = 30d0 Found XOR loop in file "Commissioner" at offset 884303; code bytes = 30d0 Found XOR loop in file "Commissioner" at offset 122211; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 243805; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 426397; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 426471; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 426655; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 426708; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 426737; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 546769; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 629178; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 635354; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 643061; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 643509; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 644085; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 644533; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 645285; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 645733; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 646309; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 646757; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 865511; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 874457; code bytes = 33c1 Found XOR loop in file "Commissioner" at offset 100479; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 606796; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 619146; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 861962; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 866398; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 869928; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 883204; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 884284; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 888180; code bytes = 8030 Found XOR loop in file "Commissioner" at offset 890356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 123420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 165647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 311692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 399415; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 512116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 562524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 568724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 631909; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 668987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 707415; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 715922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 815726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 852220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 978563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 984445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1004628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1117195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1164810; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1194769; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1259778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1308768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1321531; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1323582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1440857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1636271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1641209; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1774235; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1821879; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1882364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2000668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2067247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092835; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2293930; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2339976; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2342120; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2469422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2505737; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2546972; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2595058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2763444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2823602; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2865265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884210; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2886329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2934642; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2963910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2994942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3125982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3132449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3176136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3259935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3438122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3439544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3596336; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3632987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3655381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3688177; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3689244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3730685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3742109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3915689; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4035454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4073254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4169194; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4209152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4290066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4296577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4328039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4462218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4635068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4657977; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4687178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4746921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4771628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4798187; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4813886; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4906864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5011473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5136865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5141412; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5240462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5266336; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5295396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5308722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5313888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5413302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5452377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5461052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5494420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5591557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5612023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5671781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5704615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5951722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5974754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6302478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6307241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6387448; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6413671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6438621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6525716; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6553315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6612760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6699463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6725016; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6756215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6798846; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6861585; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6876983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6938168; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6945123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7019748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7062157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7107833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7200288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 162526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 183480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 225177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 280274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 341941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 364297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 398736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 525321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 625757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 716298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 901785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 908309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 967084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1272602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1371137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1409154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1443510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1471278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1755502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1855285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1943592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1955127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2115762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2186893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2250436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2253999; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2263957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2372877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2452201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2485974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2519744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2797044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2819635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2918746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2925263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3067549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3110689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3192510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3225681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3306885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3375078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3406605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3448542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3473230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3525079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3594183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3602954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3668852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3684067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3727081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3771729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3780969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3839825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3857724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3870342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3913992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3915887; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3916567; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3927661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3944537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3947325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3956454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3962996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4021609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4033531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4170379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4198843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4260918; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4358394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4368791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4384643; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4567701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4607702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4665597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4750072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4763951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4779382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4928536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4938464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4973074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5000526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5034099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5066172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5113883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5119144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5123585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5377614; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5527607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5568248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5589031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5633054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5771895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5797567; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5962721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6031087; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6051892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6070414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6207024; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6222820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6233372; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6249487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6295912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6310851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6326460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6333476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6344330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6537213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6560086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6599068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6603789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6605686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6618548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6633431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6684489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6794802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6908852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7141334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 46242; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 124210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 132766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 180094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 242453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 250940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 257436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276462; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 307192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 328767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 463213; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 579540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 661427; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 691950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 698417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 792263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 806201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 814433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 864506; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 866257; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 998967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1090787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1181578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1500924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1604351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1607821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1669099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1697971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1702144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1752857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1798209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1904248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1990744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2110875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2156672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2250884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2300639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2314272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2320290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2417276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2557544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2573181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2621129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2692073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2737163; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2814090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2891957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2911606; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2949313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3061751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3193555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3290403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3344576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3376313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3377985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3528196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3559453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3587868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3651129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3728594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3804969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3929586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3949256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3962820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3967706; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4019888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4029848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4059504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4295804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4295879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4358232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4419730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4456397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4477931; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4491500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4513208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4536614; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4537242; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4595586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4692060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4702607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4720128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4740190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4807966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4843829; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4934023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4952788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5133470; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5167275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5187088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5313887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5369613; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5369884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5443549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5577242; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5598701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5709490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5758306; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5849972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5988388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6034361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6113939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6281882; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6300606; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6320080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6345672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6357288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6429047; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6437806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6452803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6747972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6796905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6906113; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7028758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7030421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7061926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7119757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7222633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7242887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7243134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7244762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7255222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7255469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7257097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7267543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7267790; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7269418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7279878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7280125; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7281753; code bytes = 803030:T559,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005384-00000C2C-187442231") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005384-00000C2C-187442435") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005384-00000C2C-187442769") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00003312-00000C2C-316426340") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")31:T523,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00005856.00000001.78323.00E21000.00000020.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00005856.00000001.78323.00E21000.00000020.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")32:T67a,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00005856.00000001.78323.00E21000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00005856.00000001.78323.00E21000.00000020.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")33:T2204,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c19b14db14dc12006d82cf7594e2740004010000 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000640031003800300034003100370063006300660065006300390034003100630034003500650062003200300037003000350061003200620034003700300036002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b4f77d8a15477d8eb6b77ac016f0000006f00000000000000000014009800ff0100000000000000000000000000000000000015009300ff0100000000000000000000606f6f0000000000200000000000000000000000a8eb7200506c6f00706d6f0050e9740018716f0000000000b0c612000000000030c81200 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000420005000000000000000000000000000000e4f5120054774f77c0f412000000000014000000bf774f770000376a000000000000800040f51200f000376a00000000000000000000000000000000000000000000000000000000000000001200140098f6120068f612000100000000000000ff2b4f77989354770000000094016f0000006f0000000000000000000d0064004d000000000000000000000000000000000020000e002e004d000000c0f5120020000000606f6f004000a20001000000020000000000000088ea7200506c6f00646d6f00f0d17300e06f6f00483d7500 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e4b00270e4b00238e6b00292e02b72d25039a9feffffffb8e5b00216bc2a72baadabef01000000ece4b002b8e5b00220bc2a720600000000003f6a010000002fbc2a722a00000006000000baadabef01000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e5b002000000008e00000044e6b002feffffffcce5b002cf005077d60050772083f6758e0000004700000044e6b00200000000a0e5b0020000000008e6b00295e14b77f4600900feffffffd60050772f7b3f750100000050002406167b3f75dfc084d9 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000d82a7900aceeb00204644f7738016f00e0634f774088f6750000000000006f00e02a79006dd18c7575c884d96cae3a7600000000000000003402000078447900302f6f000100000000006f0050016f000c000000e02a7900302f6f0002000002180000006e5f0031820000000000000000000000030000004ceeb002820000007f070000000000006e5f003102000000c07594757844790000000000c075947568eeb00240306f0000000000302f6f00c0eeb002ff2b4f771888f6757400000004026f0000006f003100e20006000000000000001000000000000101ccedb002 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005384) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000270018000000aa000000000000000000000028eb2a00506b2700b86c2700781b2d006877270061007300e0d0200069007300e8dd2000781b2d00e9e94f77781b2d0000000000aa0000000cd2200044d6200000000000000000000000000000000000000000000000000000000000000000001c5c4e7760d83f75ffffffff17000000bcd120002400000003000000acd62000d8db200044d6200086000000e8d1200096ed4f779a1b2d00a06a2575860000000cd2200044d620000000000086008800a06a25750cd22000916c25759a1b2d00a06a2575a06a25757cd6200002020000 (UID: 00000000-00005560) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005560) "tasklist.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005488) "tasklist.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005488)34:Tc5c,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb6b7750e974000040fd7f9a5c507700f0fd7ff4c712004440fd7f00000000400000003f0000001e0000000040fd7fe8c71200c15c5077608257771e0000000040fd7f9a5c507700f0fd7f0cc8120057894f778083577713174075d8eb6b77 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000d8f6120002000000000000001000000018f6120034f61200c9763f7500006f0000001400da763f75f3d026db000000000000376a01000000935c5077000000000000000000000000fcf5120001000000ccf81200bd06417527500bae00000000bd14376af0d17300 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005384) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100007000700064006100740061005c006c006f00630061006c005c00740065006d0070005c003400390031003500300035005c00720065006700610073006d002e006500780065000000000000000b00010abc64000898d8a700c4d8a700f0d8a7001cd9a70048d9a70074d9a700a0d9a700 (UID: 00000000-00003312) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f44f77e6f72371a8db67060000e76c0000e76c0000000000000000f0000000f000e76c0000000014db670600000000a8dc6706000000000100000078db670640f54f77000000000000000064db6706 (UID: 00000000-00003312) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000880000002100267514db6706459dec7500001a0000000000800000000200000000006806dc1ae76c28db6706 (UID: 00000000-00003312) "RegAsm.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003312) "RegAsm.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb6b77b85c630500e0fd7f9a5c507700e0fa7f6cd6670644e0fd7f00000000400000003f0000002a00000000e0fd7f60d66706c15c5077608257772a00000000e0fd7f9a5c507700e0fa7f84d6670657894f778083577713174075d8eb6b77 (UID: 00000000-00003312)35:T462,"tasklist.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00005488) "tasklist.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00005488) "tasklist.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00005488) "tasklist.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00005460) "tasklist.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00005460) "tasklist.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00005460) "schtasks.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00005752) "schtasks.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00006008) "schtasks.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003892) "RegAsm.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003312) "schtasks.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00002164) "schtasks.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003948)36:T675,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Dr.com" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Dr.com" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ApolloPro.scr" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ApolloPro.scr" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")37:T746,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")38:T63a,GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1126-00E599D2 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1345-00E788CD GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1346-00E78D89 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1347-00E78E89 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1348-00E78EBD GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1349-00E78E20 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1350-00E78ACA GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1351-00E78CC7 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1352-00E78D28 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1355-00E79274 OpenProcessToken@ADVAPI32.DLL at 00000000-00005856-59327-1357-00E79330 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1359-00E794D9 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1360-00E79431 OpenProcessToken@ADVAPI32.DLL at 00000000-00005856-59327-1363-00E791CF GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-1364-00E7954A OpenProcess@KERNEL32.DLL at 00000000-00005856-59327-1384-00E81BDD OpenProcess@KERNEL32.DLL at 00000000-00005856-59327-1592-00E859A4 OpenProcess@KERNEL32.DLL at 00000000-00005856-59327-2008-00E9F01C OpenProcess@KERNEL32.DLL at 00000000-00005856-59327-2010-00E9F23E OpenProcess@KERNEL32.DLL at 00000000-00005856-59327-2013-00E9F6E8 OpenProcess@KERNEL32.DLL at 00000000-00005856-59327-2016-00E9F856 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-2445-00E47E83 GetProcessHeap@KERNEL32.DLL at 00000000-00005856-59327-2457-00E48DAC39:T72c,"RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "RegAsm.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3a:Td4d,"RegAsm.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\491505\RegAsm.exe" at 00000000-00003312-0000010C-11470956 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003312-0000010C-28165795 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003312-0000010C-31372381 "RegAsm.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003312-0000010C-33252749 "RegAsm.exe" queries volume information of "C:\share" at 00000000-00003312-0000010C-33254576 "RegAsm.exe" queries volume information of "C:\share" at 00000000-00003312-0000010C-33752023 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00003312-0000010C-38701026 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll" at 00000000-00003312-0000010C-39179365 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll" at 00000000-00003312-0000010C-40204851 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll" at 00000000-00003312-0000010C-41147457 "RegAsm.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00003312-0000010C-41906261 "RegAsm.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00003312-0000010C-42016301 "RegAsm.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll" at 00000000-00003312-0000010C-42353746 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00003312-0000010C-42361360 "RegAsm.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00003312-0000010C-43038355 "RegAsm.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" at 00000000-00003312-0000010C-60993473 "RegAsm.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll" at 00000000-00003312-0000010C-61001994 "RegAsm.exe" queries volume information of "C:\Program Files\AutoIt3\AutoItX\AutoItX3.PowerShell.dll" at 00000000-00003312-0000010C-610460753b:T573,"RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "RegAsm.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3c:T593,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005384) "Dr.com" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\CreativePixel Tech (UID: 00000000-00005856) "RegAsm.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003312) "RegAsm.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003312)3d:T9ce,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd" - (UID: 00000000-00005384) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00005560) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "wrsa opssvc"" - (UID: 00000000-00005560) "cmd.exe" called "CreateProcessW" with parameter "findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"" - (UID: 00000000-00005560) "cmd.exe" called "CreateProcessW" with parameter "cmd /c md 491505" - (UID: 00000000-00005560) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Reve" - (UID: 00000000-00005560) "cmd.exe" called "CreateProcessW" with parameter "Dr.com B" - (UID: 00000000-00005560) "cmd.exe" called "CreateProcessW" with parameter "choice /d y /t 15" - (UID: 00000000-00005560) "Dr.com" called "CreateProcessW" with parameter "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js'" /sc dail" - (UID: 00000000-00005856) "Dr.com" called "CreateProcessW" with parameter "schtasks.exe /create /tn "ApolloPro" /tr "wscript //B '%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js'" /sc onlogo" - (UID: 00000000-00005856) "Dr.com" called "CreateProcessW" with parameter "%TEMP%\491505\RegAsm.exe" - (UID: 00000000-00005856) "ApolloPro.scr" called "CreateProcessW" with parameter "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js'" /sc dail" - (UID: 00000000-00000836) "cmd.exe" called "CreateProcessW" with parameter "schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js'" /sc daily /mo" - (UID: 00000000-00001376) "ApolloPro.scr" called "CreateProcessW" with parameter "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js'" /sc dail" - (UID: 00000000-00001184) "ApolloPro.scr" called "CreateProcessW" with parameter "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js'" /sc dail" - (UID: 00000000-00001928) "cmd.exe" called "CreateProcessW" with parameter "schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js'" /sc daily /mo" - (UID: 00000000-00002356)3e:T79db,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter RichEd20 (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005384) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005488) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005488) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00005488) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00005488) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005488) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005488) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005488) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005460) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005460) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00005460) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00005460) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005460) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005460) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005460) "Dr.com" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter %TEMP%\491505\B (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter %WINDIR%\system32\psapi.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005856) "Dr.com" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005856) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00005752) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005752) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005752) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005752) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00006008) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006008) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006008) "ApolloPro.scr" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter %WINDIR%\system32\psapi.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00000836) "ApolloPro.scr" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000836) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003892) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003892) "ApolloPro.scr" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter %LOCALAPPDATA%\CreativePixel Tech\E (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter %WINDIR%\system32\psapi.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001184) "ApolloPro.scr" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001184) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %TEMP%\491505\ntdll.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\4dac8c5552f1563aada2236dc493eefa\Microsoft.PowerShell.Commands (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea#\45d6173bf76d6c7a206f8f41403f947b\Microsoft.PowerShell.Commands (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.We0722664#\af810cbd2f6a1dbe6b7da647fea4b26a\Microsoft.WSMan.Management.ni (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %TEMP%\491505\RegAsm.exe (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003312) "RegAsm.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003312) "ApolloPro.scr" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter %LOCALAPPDATA%\CreativePixel Tech\E (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003368) "ApolloPro.scr" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003368) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002164) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002164) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002164) "ApolloPro.scr" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter %LOCALAPPDATA%\CreativePixel Tech\E (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001320) "ApolloPro.scr" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter %LOCALAPPDATA%\CreativePixel Tech\E (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004512) "ApolloPro.scr" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter %LOCALAPPDATA%\CreativePixel Tech\E (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001928) "ApolloPro.scr" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001928) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00003948) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003948) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003948) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003948)3f:T17045,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005384) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005560) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005488) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00005488) "findstr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005740) "findstr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005740) "findstr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005740) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005740) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005460) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00005460) "findstr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005492) "findstr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005492) "findstr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005492) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005492) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005624) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005624) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005624) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005624) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005800) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005800) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005800) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005800) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00005800) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005800) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00005800) "Dr.com" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter MessageBoxIndirectW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter RtlDecompressFragment (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00005856) "Dr.com" called "GetProcAddress" with a parameter NtResumeThread (UID: 00000000-00005856) "choice.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005784) "choice.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005784) "choice.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005784) "choice.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005784) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005604) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005604) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005604) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005604) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005752) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005752) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005752) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005752) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005752) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00006008) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00006008) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00006008) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006008) "ApolloPro.scr" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00000836) "ApolloPro.scr" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000836) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00001376) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00001376) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003892) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003892) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003892) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003892) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003892) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003892) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003892) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003892) "ApolloPro.scr" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001184) "ApolloPro.scr" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001184) "RegAsm.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NtSetInformationProcess (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003312) "RegAsm.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003312) "ApolloPro.scr" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003368) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003368) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004340) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002164) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002164) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002164) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002164) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002164) "ApolloPro.scr" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00001320) "ApolloPro.scr" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00004512) "ApolloPro.scr" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateSemaphoreA (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001928) "ApolloPro.scr" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001928) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002356) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002356) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002356) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002356) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00002356) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00002356) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00002356) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003948) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003948) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003948) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003948)40:T544,Sleep@KERNEL32.DLL at 00000000-00005856-59327-66-00E4A362 Sleep@KERNEL32.DLL at 00000000-00005856-59327-132-00E644DF Sleep@KERNEL32.DLL at 00000000-00005856-59327-578-00E82BAF Sleep@KERNEL32.DLL at 00000000-00005856-59327-636-00E857FF WaitForSingleObject@KERNEL32.DLL at 00000000-00005856-59327-692-00E877EB WaitForSingleObject@KERNEL32.DLL at 00000000-00005856-59327-696-00E92E47 SetTimer at 00000000-00005856-59327-858-00E22BA9 Sleep@KERNEL32.DLL at 00000000-00005856-59327-1058-00E2E00D Sleep@KERNEL32.DLL at 00000000-00005856-59327-1062-00E2E36D SetTimer at 00000000-00005856-59327-1168-00E34D83 Sleep@KERNEL32.DLL at 00000000-00005856-59327-1170-00E82CCE SetTimer at 00000000-00005856-59327-1174-00E35B29 Sleep@KERNEL32.DLL at 00000000-00005856-59327-1330-00E7729E WaitForSingleObject@KERNEL32.DLL at 00000000-00005856-59327-1364-00E7954A Sleep@KERNEL32.DLL at 00000000-00005856-59327-1366-00E795D7 Sleep@KERNEL32.DLL at 00000000-00005856-59327-1391-00E7A226 SetTimer at 00000000-00005856-59327-1448-00E7CB97 Sleep@KERNEL32.DLL at 00000000-00005856-59327-1520-00E81941 WaitForSingleObject@KERNEL32.DLL at 00000000-00005856-59327-1581-00E8504E Sleep@KERNEL32.DLL at 00000000-00005856-59327-1586-00E85530 Sleep@KERNEL32.DLL at 00000000-00005856-59327-1637-00E8FA36 Sleep@KERNEL32.DLL at 00000000-00005856-59327-1647-00E8B80041:T813,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "LockResource" (Indicator: "LockResource"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")42:Tc82,"RegAsm.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%TEMP%\491505\ntdll.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]43:T9e8,"Software\AutoIt v3\AutoIt" in Source: 00000000-00000836.00000000.80632.000F0000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00000836.00000000.80632.000F0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00000836.00000000.80632.000F0000.00000002.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00001320.00000000.84620.000F0000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001320.00000000.84620.000F0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00001320.00000000.84620.000F0000.00000002.mdmp "HKEY_CLASSES_ROOT\Record\" in Source: 00000000-00003312.00000000.82668.00812000.00000020.mdmp "HKEY_CLASSES_ROOT\" in Source: 00000000-00003312.00000000.82668.00812000.00000020.mdmp "HKEY_CLASSES_ROOT\CLSID\" in Source: 00000000-00003312.00000000.82668.00812000.00000020.mdmp "HKEY_CLASSES_ROOT\TypeLib\" in Source: 00000000-00003312.00000000.82668.00812000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003312.00000001.84488.00A00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003312.00000001.84488.00A00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003312.00000002.86411.00A00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003312.00000002.86411.00A00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003312.00000002.86411.055E0000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00003368.00000000.83344.000F1000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00003368.00000000.83344.000F1000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00003368.00000000.83344.000F1000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005384.00000001.75528.00409000.00000002.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005856.00000001.78323.00EB0000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005856.00000001.78323.00EB0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005856.00000001.78323.00EB0000.00000002.mdmp44:T3d2d,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e60000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "SHFOLDER" at base 72ae0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "OLE32.DLL" at base 75a40000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "KERNEL32.DLL" at base 75880000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "COMCTL32.DLL" at base 74270000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "OLEAUT32.DLL" at base 75fc0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "ADVAPI32.DLL" at base 75e10000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75880000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "SETUPAPI.DLL" at base 756e0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "RPCRT4.DLL" at base 77140000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "CLBCATQ.DLL" at base 75ba0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73f70000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "NTMARTA.DLL" at base 74810000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77620000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "PROFAPI.DLL" at base 753b0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "RICHED20" at base 6a370000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "DWMAPI.DLL" at base 73eb0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "COMCTL32.DLL" at base 71b30000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75a40000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 762d0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "SHELL32.DLL" at base 764f0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "PROPSYS.DLL" at base 73f70000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "APPHELP.DLL" at base 75250000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a3f0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 755e0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 763a0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "SECUR32.DLL" at base 750e0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 756d0000 "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75250000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75880000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75250000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b8d0000 "tasklist.exe" loaded module "ADVAPI32.DLL" at base 75e10000 "tasklist.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77620000 "tasklist.exe" loaded module "CLBCATQ.DLL" at base 75ba0000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75880000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6de50000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 75310000 "tasklist.exe" loaded module "KERNEL32.DLL" at base 75880000 "tasklist.exe" loaded module "CRYPTSP.DLL" at base 74db0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b40000 "tasklist.exe" loaded module "CRYPTBASE.DLL" at base 752a0000 "tasklist.exe" loaded module "RPCRTREMOTE.DLL" at base 75340000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d810000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e000000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6d7f0000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 77140000 "tasklist.exe" loaded module "OLEAUT32.DLL" at base 75fc0000 "findstr.exe" loaded module "KERNEL32.DLL" at base 75880000 "Dr.com" loaded module "KERNEL32.DLL" at base 75880000 "Dr.com" loaded module "DWMAPI.DLL" at base 73eb0000 "Dr.com" loaded module "COMCTL32.DLL" at base 74270000 "Dr.com" loaded module "UXTHEME.DLL" at base 73e60000 "Dr.com" loaded module "IMM32.DLL" at base 776d0000 "Dr.com" loaded module "COMCTL32" at base 74270000 "Dr.com" loaded module "SHELL32.DLL" at base 764f0000 "Dr.com" loaded module "OLE32.DLL" at base 75a40000 "Dr.com" loaded module "PSAPI.DLL" at base 75c30000 "Dr.com" loaded module "MSVCRT.DLL" at base 75ec0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 75880000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 752a0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e60000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77140000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77620000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 75e10000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 75ba0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 739b0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75230000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73aa0000 "ApolloPro.scr" loaded module "KERNEL32.DLL" at base 75880000 "ApolloPro.scr" loaded module "DWMAPI.DLL" at base 73eb0000 "ApolloPro.scr" loaded module "COMCTL32.DLL" at base 74270000 "ApolloPro.scr" loaded module "UXTHEME.DLL" at base 73e60000 "ApolloPro.scr" loaded module "IMM32.DLL" at base 776d0000 "ApolloPro.scr" loaded module "COMCTL32" at base 74270000 "ApolloPro.scr" loaded module "SHELL32.DLL" at base 764f0000 "ApolloPro.scr" loaded module "OLE32.DLL" at base 75a40000 "ApolloPro.scr" loaded module "PSAPI.DLL" at base 75c30000 "ApolloPro.scr" loaded module "MSVCRT.DLL" at base 75ec0000 "ApolloPro.scr" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e60000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70b80000 "RegAsm.exe" loaded module "KERNEL32" at base 75880000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 649a0000 "RegAsm.exe" loaded module "USER32.DLL" at base 75d40000 "RegAsm.exe" loaded module "MSCOREE.DLL" at base 6c0a0000 "RegAsm.exe" loaded module "PSAPI.DLL" at base 75c30000 "RegAsm.exe" loaded module "RPCRT4.DLL" at base 77140000 "RegAsm.exe" loaded module "KERNEL32.DLL" at base 75880000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63590000 "RegAsm.exe" loaded module "OLE32.DLL" at base 75a40000 "RegAsm.exe" loaded module "CRYPTBASE.DLL" at base 752a0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e60000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72230000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a150000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6ce00000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62b30000 "RegAsm.exe" loaded module "ADVAPI32.DLL" at base 75e10000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62310000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 654a0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 614a0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60d20000 "RegAsm.exe" loaded module "SHELL32.DLL" at base 764f0000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77620000 "RegAsm.exe" loaded module "PROFAPI.DLL" at base 753b0000 "RegAsm.exe" loaded module "BCRYPT.DLL" at base 74ec0000 "RegAsm.exe" loaded module "CRYPTSP.DLL" at base 74db0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b40000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 60c10000 "RegAsm.exe" loaded module "NTDLL.DLL" at base 774a0000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77620000 "RegAsm.exe" loaded module "RPCRTREMOTE.DLL" at base 75340000 "RegAsm.exe" loaded module "UXTHEME.DLL" at base 73e60000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5f120000 "RegAsm.exe" loaded module "WS2_32.DLL" at base 77640000 "RegAsm.exe" loaded module "VERSION.DLL" at base 74840000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74d70000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 748d0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74d60000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P1706CAFE#\4DAC8C5552F1563AADA2236DC493EEFA\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 6b630000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6c490000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 68db0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P521220EA#\45D6173BF76D6C7A206F8F41403F947B\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 5e5b0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5e3d0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6a0d0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 68cb0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.WE0722664#\AF810CBD2F6A1DBE6B7DA647FEA4B26A\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 5e340000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5db20000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5d7c0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 5d690000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5d560000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6a300000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d4a0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 68c60000 "RegAsm.exe" loaded module "SECUR32.DLL" at base 750e0000 "RegAsm.exe" loaded module "SSPICLI.DLL" at base 75230000 "RegAsm.exe" loaded module "SHLWAPI.DLL" at base 75ce0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5d270000 "RegAsm.exe" loaded module "WINTRUST.DLL" at base 75690000 "RegAsm.exe" loaded module "MSISIP.DLL" at base 72310000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 754b0000 "RegAsm.exe" loaded module "IMM32.DLL" at base 776d0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6ce70000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 70b30000 "RegAsm.exe" loaded module "URLMON.DLL" at base 763a0000 "RegAsm.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 756d0000 "RegAsm.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 708e0000 "RegAsm.exe" loaded module "OLEAUT32.DLL" at base 75fc0000 "RegAsm.exe" loaded module "NCRYPT.DLL" at base 74ee0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74a80000 "RegAsm.exe" loaded module "USERENV.DLL" at base 75490000 "RegAsm.exe" loaded module "GPAPI.DLL" at base 74980000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77620000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77620000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71a20000 "RegAsm.exe" loaded module "CRYPTNET.DLL" at base 71a20000 "RegAsm.exe" loaded module "SENSAPI.DLL" at base 722e0000 "RegAsm.exe" loaded module "WINHTTP.DLL" at base 716b0000 "RegAsm.exe" loaded module "CREDSSP.DLL" at base 74a70000 "RegAsm.exe" loaded module "IPHLPAPI.DLL" at base 73700000 "RegAsm.exe" loaded module "DHCPCSVC6.DLL" at base 73610000 "RegAsm.exe" loaded module "DHCPCSVC.DLL" at base 735a0000 "RegAsm.exe" loaded module "NSI.DLL" at base 77600000 "RegAsm.exe" loaded module "CFGMGR32.DLL" at base 75460000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77620000 "RegAsm.exe" loaded module "DNSAPI.DLL" at base 74c30000 "RegAsm.exe" loaded module "RASADHLP.DLL" at base 718d0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73630000 "RegAsm.exe" loaded module "CRYPT32.DLL" at base 754b0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5d160000 "RegAsm.exe" loaded module "COMCTL32.DLL" at base 74270000 "RegAsm.exe" loaded module "GDI32.DLL" at base 75f7000045:T43e,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706" was detected as "Microsoft Linker" and name: "Linker" "Dr.com" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Dr.com" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Dr.com" was detected as "Microsoft Linker" and name: "Linker" "RegAsm.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "RegAsm.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "RegAsm.exe" was detected as "Microsoft Linker" and name: "Linker" "Artistic" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Artistic" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Artistic" was detected as "Microsoft Linker" and name: "Linker"46:T1548,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "RegAsm.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")47:T10a8,Process "cmd.exe" (UID: 00000000-00005560) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00005560) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "tasklist.exe" (UID: 00000000-00005488) was launched with new environment variables: "Occasion="v", Nba="d", Worthy="C", Tokyo="l", Degree="r", Trance=".", Indirect="I", Ron="s", Donors="Y", Peoples="z", Surgeons="K", Derek="3", Show="u", Walls="+", PROMPT="$P$G", Powerpoint="f", Retention="4", Moscow="Q", Stands="x", gBoJIpopEbLInACJADdVSerkhVR="Dr.com", Appliance="k", Feedback="/", Ons="8", Rh="h", Amount="5", Blond="D", Electoral="M", Afraid="J", Holiday="j", Xml="e"" Process "tasklist.exe" (UID: 00000000-00005460) was launched with new environment variables: "Legs="491505"" Process "ApolloPro.scr" (UID: 00000000-00000836) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "ApolloPro.scr" (UID: 00000000-00000836) was launched with missing environment variables: "Occasion, Nba, Worthy, Tokyo, USERDNSDOMAIN, Degree, Trance, Indirect, Ron, Donors, Peoples, Surgeons, Derek, Show, Walls, PROMPT, Powerpoint, Retention, Moscow, Stands, gBoJIpopEbLInACJADdVSerkhVR, Appliance, Feedback, Ons, Rh, Legs, Amount, Blond, Electoral, Afraid, Holiday, Xml" Process "cmd.exe" (UID: 00000000-00001376) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00001376) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "schtasks.exe" (UID: 00000000-00003892) was launched with new environment variables: "PROMPT="$P$G"" Process "ApolloPro.scr" (UID: 00000000-00001184) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "ApolloPro.scr" (UID: 00000000-00001184) was launched with missing environment variables: "PROMPT, USERDNSDOMAIN" Process "RegAsm.exe" (UID: 00000000-00003312) was launched with new environment variables: "Occasion="v", Nba="d", Worthy="C", Tokyo="l", USERDNSDOMAIN="%OSUSER%-PC", Degree="r", Trance=".", Indirect="I", Ron="s", Donors="Y", Peoples="z", Surgeons="K", Derek="3", Show="u", Walls="+", PROMPT="$P$G", Powerpoint="f", Retention="4", Moscow="Q", Stands="x", gBoJIpopEbLInACJADdVSerkhVR="Dr.com", Appliance="k", Feedback="/", Ons="8", Rh="h", Legs="491505", Amount="5", Blond="D", Electoral="M", Afraid="J", Holiday="j", Xml="e"" Process "RegAsm.exe" (UID: 00000000-00003312) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "ApolloPro.scr" (UID: 00000000-00003368) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "ApolloPro.scr" (UID: 00000000-00003368) was launched with missing environment variables: "Occasion, Nba, Worthy, Tokyo, USERDNSDOMAIN, Degree, Trance, Indirect, Ron, Donors, Peoples, Surgeons, Derek, Show, Walls, PROMPT, Powerpoint, Retention, Moscow, Stands, gBoJIpopEbLInACJADdVSerkhVR, Appliance, Feedback, Ons, Rh, Legs, Amount, Blond, Electoral, Afraid, Holiday, Xml" Process "cmd.exe" (UID: 00000000-00004340) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00004340) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "schtasks.exe" (UID: 00000000-00002164) was launched with new environment variables: "PROMPT="$P$G"" Process "ApolloPro.scr" (UID: 00000000-00001320) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "ApolloPro.scr" (UID: 00000000-00001320) was launched with missing environment variables: "PROMPT, USERDNSDOMAIN" Process "cmd.exe" (UID: 00000000-00002356) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00002356) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "schtasks.exe" (UID: 00000000-00003948) was launched with new environment variables: "PROMPT="$P$G"" Process "ApolloPro.scr" (UID: 00000000-00001540) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "ApolloPro.scr" (UID: 00000000-00001540) was launched with missing environment variables: "PROMPT, USERDNSDOMAIN"48:T51f,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Dr.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Dr.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Dr.com" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")49:Tf2f,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005384-00000C2B-183827206] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005384-00000C2B-185465709] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005384-00000C2B-185647220] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00005488-00000C2B-192580312] Observed system executable string:"%WINDIR%\system32\psapi.dll" [Source: 00000000-00005856-00000C2B-214165556] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003312-00000C2B-300162890] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003312-00000C2B-303512129] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003312-00000C2B-303911368] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003312-00000C2B-304473410] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003312-00000C2B-304673432] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003312-00000C2B-306221832] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003312-00000C2B-307975874] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003312-00000C2B-308323080] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003312-00000C2B-308550131] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003312-00000C2B-308826513] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003312-00000C2B-309113597] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003312-00000C2B-309850381] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003312-00000C2B-310080895] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003312-00000C2B-310338644] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003312-00000C2B-310973369] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003312-00000C2B-311895167] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003312-00000C2B-313764255] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003312-00000C2B-314742058] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00003312-00000C2B-316087039] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003312-00000C2B-320084397]4a:Tb22,Spawned process "cmd.exe" with commandline "/c copy Audit Audit.cmd && Audit.cmd" (UID: 00000000-00005560) Spawned process "tasklist.exe" (UID: 00000000-00005488) Spawned process "findstr.exe" with commandline "findstr /I "wrsa opssvc"" (UID: 00000000-00005740) Spawned process "tasklist.exe" (UID: 00000000-00005460) Spawned process "findstr.exe" with commandline "findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth ..." (UID: 00000000-00005492), Spawned process "cmd.exe" with commandline "cmd /c md 491505" (UID: 00000000-00005624), Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Dentists + ..\\Flavor + ..\\Disturbed + ..\\ ..." (UID: 00000000-00005800), Spawned process "Dr.com" with commandline "B" (UID: 00000000-00005856), Spawned process "choice.exe" with commandline "choice /d y /t 15" (UID: 00000000-00005784), Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALA ..." (UID: 00000000-00005604) Spawned process "schtasks.exe" with commandline "/create /tn "ApolloPro" /tr "wscript //B '%LOCALAPPDATA%\\Creati ..." (UID: 00000000-00005752), Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePix ..." (UID: 00000000-00006008), Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00000836), Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALA ..." (UID: 00000000-00001376) Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePix ..." (UID: 00000000-00003892), Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001184), Spawned process "RegAsm.exe" (UID: 00000000-00003312), Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00003368), Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALA ..." (UID: 00000000-00004340), Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePix ..." (UID: 00000000-00002164) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001320) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00004512) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001928) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00004960) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00000924)4b:Tb22,Spawned process "cmd.exe" with commandline "/c copy Audit Audit.cmd && Audit.cmd" (UID: 00000000-00005560) Spawned process "tasklist.exe" (UID: 00000000-00005488) Spawned process "findstr.exe" with commandline "findstr /I "wrsa opssvc"" (UID: 00000000-00005740) Spawned process "tasklist.exe" (UID: 00000000-00005460) Spawned process "findstr.exe" with commandline "findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth ..." (UID: 00000000-00005492), Spawned process "cmd.exe" with commandline "cmd /c md 491505" (UID: 00000000-00005624), Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Dentists + ..\\Flavor + ..\\Disturbed + ..\\ ..." (UID: 00000000-00005800), Spawned process "Dr.com" with commandline "B" (UID: 00000000-00005856), Spawned process "choice.exe" with commandline "choice /d y /t 15" (UID: 00000000-00005784), Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALA ..." (UID: 00000000-00005604) Spawned process "schtasks.exe" with commandline "/create /tn "ApolloPro" /tr "wscript //B '%LOCALAPPDATA%\\Creati ..." (UID: 00000000-00005752), Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePix ..." (UID: 00000000-00006008), Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00000836), Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALA ..." (UID: 00000000-00001376) Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePix ..." (UID: 00000000-00003892), Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001184), Spawned process "RegAsm.exe" (UID: 00000000-00003312), Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00003368), Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALA ..." (UID: 00000000-00004340), Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePix ..." (UID: 00000000-00002164) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001320) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00004512) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001928) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00004960) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00000924)4c:T674,The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: DB:D3:85:EE:62:DB:D2:3E:7B:E4:F6:71:48:50:87:24:D5:86:5B:45; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB" (SHA1: 9F:99:B7:88:DF:FF:B1:18:44:E7:72:AF:FE:C2:9D:D9:1B:12:B8:BC; see report for more information)4d:Tc48,"Dr.com" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\491505\Dr.com]- [targetUID: 00000000-00005560] "RegAsm.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\491505\RegAsm.exe]- [targetUID: 00000000-00005856] "Audit.cmd" has type "ASCII text with very long lines (677) with CRLF line terminators"- Location: [%TEMP%\Audit.cmd]- [targetUID: 00000000-00005560] "B" has type "data"- Location: [%TEMP%\491505\B]- [targetUID: 00000000-00005800] "Dentists" has type "data"- Location: [%TEMP%\Dentists]- [targetUID: 00000000-00005384] "Disturbed" has type "data"- Location: [%TEMP%\Disturbed]- [targetUID: 00000000-00005384] "Proceeds" has type "data"- Location: [%TEMP%\Proceeds]- [targetUID: 00000000-00005384] "Justice" has type "OpenPGP Secret Key"- Location: [%TEMP%\Justice]- [targetUID: 00000000-00005384] "Artistic" has type "DOS executable (COM) maybe with interrupt 22h start instruction 0x8cdc8456 cd5761f7"- Location: [%TEMP%\Artistic]- [targetUID: 00000000-00005384] "Zip" has type "data"- Location: [%TEMP%\Zip]- [targetUID: 00000000-00005384] "Flavor" has type "data"- Location: [%TEMP%\Flavor]- [targetUID: 00000000-00005384] "Soundtrack" has type "data"- Location: [%TEMP%\Soundtrack]- [targetUID: 00000000-00005384] "Revenue" has type "MPEG-4 LOAS"- Location: [%TEMP%\Revenue]- [targetUID: 00000000-00005384] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00003312] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003312] "3130B1871A126520A8C47861EFE3ED4D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D]- [targetUID: 00000000-00003312] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003312] "3130B1871A126520A8C47861EFE3ED4D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D]- [targetUID: 00000000-00003312] "ApolloPro.js" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js]- [targetUID: 00000000-00005856] "ApolloPro.scr" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.scr]- [targetUID: 00000000-00005856] "Commissioner" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\Commissioner]- [targetUID: 00000000-00005384] "Audit" has type "ASCII text with very long lines (677) with CRLF line terminators"- Location: [%TEMP%\Audit]- [targetUID: 00000000-00005384]4e:Tbbe,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "")4f:T12a7,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "6092579A997945B10D3F279693BAA004D180417CCFEC941C45EB20705A2B4706"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "")50:T53f,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to retrieve type of COM object Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size51:Tbae,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe.Local\" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\VERSION.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\FLTLIB.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\MSVCP140.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\VCRUNTIME140.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\ucrtbase.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll"52:Td73,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\VERSION.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\FLTLIB.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\MSVCP140.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\ucrtbase.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"53:T984,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe.Local\" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Commissioner" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Disturbed" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Windows\system32\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Windows\system\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Windows\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Windows\System32\Wbem\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MusclesPacket" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Audit" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Proceeds" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Flavor" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\VacationHeadsLowest" "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\VacationHeadsLowest"54:T6fe,Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")55:Teb2,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003312-00000C2C-343389666") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003312-00000C2C-344747769") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003312-00000C2C-344748136") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003312-00000C2C-344748136") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003312-00000C2C-344748136") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003312-00000C2C-347343281") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003312-00000C2C-347343281") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003312-00000C2C-350301055") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003312-00000C2C-350301596") Found reference to API "get_EnableInternetOpenWith" (Indicator: "InternetOpen"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "set_EnableInternetOpenWith" (Indicator: "InternetOpen"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "EnableInternetOpenWith" (Indicator: "InternetOpen"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")56:T4c4,Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "get_EnableInternetOpenWith" (Indicator: "InternetOpen"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "set_EnableInternetOpenWith" (Indicator: "InternetOpen"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "EnableInternetOpenWith" (Indicator: "InternetOpen"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")57:Tc50,file/memory contains long string with (Indicator: " socket "; File: "Audit.cmd") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "gethostname" (Indicator: "gethostname"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetHostName" (Indicator: "gethostname"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000836.00000000.80632.00FB0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000924.00000000.87551.01010000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001184.00000000.82138.00FF0000.00000002.mdmp, 00000000-00001184.00000001.84064.00FF0000.00000002.mdmp, 00000000-00001184.00000002.85986.00FF0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001320.00000001.86480.01010000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001928.00000000.86614.00F30000.00000002.mdmp") Found reference to API "ocket must be UDP socket !" (Indicator: " socket "; Source: "00000000-00003312.00000001.84488.009B0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003312.00000001.84488.01430000.00000002.mdmp, 00000000-00003312.00000002.86411.01430000.00000002.mdmp")58:T5f7,"0.0.0.0" "255.255.255.255" "2.5.29.37" "2.5.29.35" "2.5.29.1" "2.5.29.31" "5.255.255.255" "4.0.0.0" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" "14.0.0.0" "1.0.0.0" "192.168.0.2" Potential IP "1.0.1.0" found in string "tarksoft.aspen,1.0.1.0,,56b8923a24d03eb3" Potential IP "3.0.0.0" found in string "onsoleHost,3.0.0.0,," Potential IP "3.0.0.0" found in string "ecurity,3.0.0.0,,31b" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />", Potential IP "4.0.0.0" found in string "on=4.0.0.0 Culture=", Potential IP "4.0.0.0" found in string "n=4.0.0.0 C", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul", Potential IP "4.0.0.0" found in string "=4.0.0.0 Cu", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089"/>" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Security.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.WSMan.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "0.0.0.0" found in string "0.0.0.0, Cul" Potential IP "1.0.0.0" found in string ":\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0"59:T33b6,Found URL "http://www.autoitscript.com/autoit3/filedescriptionautoit" - Source: "00000000-00000836.00000000.80632.00129000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=216365" - Source: "00000000-00003312.00000002.86411.001A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0@wosgytwo&" - Source: "00000000-00003312.00000002.86411.02030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0'(a*_s^)w>" - Source: "00000000-00003312.00000002.86411.02030000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00003312.00000002.86411.02030000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crltp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7afbb18927a52cc2pmapperpmapper52:aystem.dataystem.dataystem.dataystem.dataystem.webystem.dataystem.webystem.webystem.webystem.webystem.dataxyzqrstulmnopghijkbcdef]^_" - Source: "00000000-00003312.00000002.86411.02130000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crlicrosoft.csharp," - Source: "00000000-00003312.00000002.86411.02130000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cablocal" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0@wosgytwo&" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0'(a*_s^)w>" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.microspki/.crtw>" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/jom5osalt" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9nd" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5ostaat" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0g-o3g-orjg-o9g-oug-oiog-outg-otrg-o8zg-o1y85gg-oigg-ojg-o0g-oh@zo:g-o:/g-oitg-ousg-o" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,verisign" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n/" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!internet1verisign," - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!salt" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.,entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0phla.comorat0a0" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrustpob\hzagi$l,0_afionvom2p]?" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys\1]fgeotrust" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/^hcroducts/miccerlisca2011_2011-03^hcrq0o0mahtt^hwwcrosoft.com/pki/certs/miccerli^h0111-03-29.crt0w" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.microsoft.com/p^hericrooceraut_2010-06-23.crt07^h00+a6" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!aeee" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lasycaeeeqqqqqqqqqqqqqqqqconnconltcpchconnonicbnonicfnonic0" - Source: "00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00005384.00000001.75528.00409000.00000002.mdmp")5a:T44e,Found string "WinSCP" (Indicator: "winscp"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "Orcus.Commands.Passwords.Applications.WinSCP" (Indicator: "winscp"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "WinSCPDecrypt" (Indicator: "winscp"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "b__2_0" (Indicator: "winscp"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "ARE\\Martin Prikryl\\WinSCP 2\\Sessions" (Indicator: "winscp"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "FOrcus.Commands.Passwords.Applications.WinSCP.WinSCP+d__0" (Indicator: "winscp"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "orcus.commands.passwords.applications.winscp" (Indicator: "winscp"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "winscp" (Indicator: "winscp"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp")5b:T838,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00005856.00000001.78323.00E21000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00005856.00000001.78323.00E21000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")5c:T9e3,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "FindFirstFileW" with parameter WorldcatQatarCliff (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "FindFirstFileW" with parameter %TEMP%\cmd.* (UID: 00000000-00005384) "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\cmd.* (UID: 00000000-00005384) "cmd.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\*.* (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter ACCTRES.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter acproxy.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter ActionQueue.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter activeds.tlb (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00005560) "cmd.exe" called "FindNextFileW" with parameter AdapterTroubleshooter.exe (UID: 00000000-00005560)5d:T1438,Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "GZipStream" (Indicator: "GzipStream"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "Orcus.Shared.Encryption" (Indicator: ".encrypt"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "ToBase64String" (Indicator: "base64"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "AesEngine" (Indicator: "aes"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "CryptoStream" (Indicator: "cryptostream"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "set_AESKeySize" (Indicator: "aes"; File: "00003312.00000CF0.99729604.002C0000.wprm") file/memory contains long string with (Indicator: "aes"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "s encoding="base64">" (Indicator: "base64"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string ")\s*(?([0-9]{1,4}?)).*?(?(.*?)).*?(?(.*?))" (Indicator: "base64"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003312.00000001.84488.001B4000.00000004.mdmp, 00000000-00003312.00000001.84488.00EA0000.00000004.mdmp, 00000000-00003312.00000001.84488.00EE0000.00000004.mdmp, 00000000-00003312.00000002.86411.001B4000.00000004.mdmp, 00000000-00003312.00000002.86411.00E90000.00000004.mdmp, 00000000-00003312.00000002.86411.00EA0000.00000004.mdmp, 00000000-00003312.00000002.86411.00EB0000.00000004.mdmp, 00000000-00003312.00000002.86411.00ED0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003312.00000001.84488.001B4000.00000004.mdmp, 00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000001.84488.00EA0000.00000004.mdmp, 00000000-00003312.00000002.86411.001B4000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E90000.00000004.mdmp, 00000000-00003312.00000002.86411.00EA0000.00000004.mdmp, 00000000-00003312.00000002.86411.00EB0000.00000004.mdmp, 00000000-00003312.00000002.86411.00ED0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00003312.00000001.84488.001B4000.00000004.mdmp, 00000000-00003312.00000002.86411.001B4000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.055E0000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00003312.00000001.84488.00EA0000.00000004.mdmp, 00000000-00003312.00000002.86411.00EA0000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00003312.00000001.84488.00EA0000.00000004.mdmp, 00000000-00003312.00000002.86411.00EA0000.00000004.mdmp")5e:T1274,Found string "passwordList" (Indicator: "password"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "password" (Indicator: "password"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "passwordField" (Indicator: "password"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string ")\s*(?([0-9]{1,4}?)).*?(?(.*?)).*?(?(.*?))" (Indicator: "password"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "orcus.commands.passwords.applications.mozilla.cryptography" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.mozilla" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.yandex" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.windows" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.chrome" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.internetexplorer.native" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "secretentry" (Indicator: "secret"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "ieautocompltesecretheader" (Indicator: "secret"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.utilities" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "d__1" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "d__0" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.winscp" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "ipasswordrecovery" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.filezilla" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "passwordscommand" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.internetexplorer" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.pidgin" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "iesecretinfoheader" (Indicator: "secret"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "passwordrecoverycommandex" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp") Found string "orcus.commands.passwords.applications.jdownloader" (Indicator: "password"; Source: "00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp")5f:T4c1,Found string "SELECT * FROM Win32_LogonSession" (Indicator: " Win32_LogonSession"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "ECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "ECT ProcessId FROM Win32_Service" (Indicator: " Win32_Service"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "t * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "LECT * FROM Win32_PhysicalMemory" (Indicator: " Win32_PhysicalMemory"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "ELECT * FROM Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "* FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "Select * from Win32_PnPEntity" (Indicator: " Win32_PnPEntity"; File: "00003312.00000CF0.99729604.002C0000.wprm") Found string "ect * from Win32_PnPSignedDriver" (Indicator: " Win32_pnpsigneddriver"; File: "00003312.00000CF0.99729604.002C0000.wprm")60:T5f4,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp")61:T1022,Found reference to API "CopySid" (Indicator: "CopySid"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "AddAce" (Indicator: "AddAce"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "GetAce" (Indicator: "GetAce"; File: "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000836.00000000.80632.000F0000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001320.00000000.84620.000F0000.00000002.mdmp")62:T8e9,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Dr.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Dr.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Dr.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Dr.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Dr.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Dr.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Dr.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")63:T46a,Dropped file: "ModuleAnalysisCache" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00003312] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003312] Dropped file: "3130B1871A126520A8C47861EFE3ED4D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\3130B1871A126520A8C47861EFE3ED4D]- [targetUID: 00000000-00003312] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003312] Dropped file: "3130B1871A126520A8C47861EFE3ED4D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D]- [targetUID: 00000000-00003312] Dropped file: "ApolloPro.js" - Location: [%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.js]- [targetUID: 00000000-00005856] Dropped file: "ApolloPro.scr" - Location: [%LOCALAPPDATA%\CreativePixel Tech\ApolloPro.scr]- [targetUID: 00000000-00005856]64:T4d0,"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" wrote 25715 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Commissioner": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Dr.com" wrote 41640 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\CreativePixel Tech\ApolloPro.scr": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Dr.com" wrote 64704 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\491505\RegAsm.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...65:T1001,Spawned process "6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe" (UID: 00000000-00005384) Spawned process "cmd.exe" with commandline "/c copy Audit Audit.cmd && Audit.cmd" (UID: 00000000-00005560) Spawned process "tasklist.exe" (UID: 00000000-00005488) Spawned process "findstr.exe" with commandline "findstr /I "wrsa opssvc"" (UID: 00000000-00005740) Spawned process "tasklist.exe" (UID: 00000000-00005460) Spawned process "findstr.exe" with commandline "findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"" (UID: 00000000-00005492) Spawned process "cmd.exe" with commandline "cmd /c md 491505" (UID: 00000000-00005624) Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Dentists + ..\\Flavor + ..\\Disturbed + ..\\Artistic + ..\\Justice + ..\\Proceeds + ..\\Zip + ..\\Soundtrack + ..\\Revenue B" (UID: 00000000-00005800) Spawned process "Dr.com" with commandline "B" (UID: 00000000-00005856) Spawned process "choice.exe" with commandline "choice /d y /t 15" (UID: 00000000-00005784) Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00005604) Spawned process "schtasks.exe" with commandline "/create /tn "ApolloPro" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc onlogon /F /RL HIGHEST" (UID: 00000000-00005752) Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00006008) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00000836) Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00001376) Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00003892) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001184) Spawned process "RegAsm.exe" (UID: 00000000-00003312) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00003368) Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00004340) Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00002164) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001320) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00004512) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001928) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00004960) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00000924) Spawned process "cmd.exe" with commandline "cmd /c schtasks.exe /create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00002356) Spawned process "schtasks.exe" with commandline "/create /tn "West" /tr "wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST" (UID: 00000000-00003948) Spawned process "ApolloPro.scr" with commandline ""%LOCALAPPDATA%\\CreativePixel Tech\\E"" (UID: 00000000-00001540)66:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==67:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==68:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==69:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==6a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==6b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==6c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==6d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==6e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==6f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==70:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==71:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==73:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAB4iIiIiIiIiIiIhwAAAAAH/4iIiI+IiIj4iIhwAAAA+IiPj/gREREREY//iAAAB/eHd/9xERERERcX//hwAH/3d4gRERERERERFxj/hwCI/4j4EReIiHERdxER/4gAiP//EXj/////9xERF3/4AIj/+BGP//////8RFxEY+ACI/xER//94+P//d3cRcfgAiP8REf//EYF//3EXERH4AIj3ERH/94j4F/+BERERiACIgREX/4GP/xf/gREREYgAj3ERGP/4iPh///cRERGIAI8REX///xeB///4ERERiACIERF///93F////xEREYgAiBERj///+Ij///8RERGIAIgREf//+IiIiP//cRkR+ACIERH/iIiIiIiI/3EZEfgAiHkRiIiI//+IiIiHmRf4AIh5F/iI////j/+Ih5l4+ACPdxj/+P///4///4iRj/gAj3cY///////4//+IEf/4AI+Hd///iIiP+P//93j/+ACI93f///+P//+P/3GP//gAiP93j////////3F4///4AHj/h4j///////gXj///+AAHj/93iP///4d3j////4AAAPj/+HeIiIh3eP////8AAAAIiIj4iIiIj/j///+AAAAAAI/4iP////iIiIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790550788801,"unified_at":"2026-09-27T23:13:08.801Z","metadata":{"hashes":{"sha256":"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","sha1":"d22ccae2971df83812acaebc750d9a2c87357fe5","md5":"a67e34baacfca98f323981d3b0087f3b","sha512":"39c7a33ab14e518a09f4e022c1c61c8b5a88417af3ce5a1769ab8c0fa328a178fcd79a098c4c7f3344df75e2b7cd22ebf6a88d43ad61599c53a3c89d54c29d6d","ssdeep":"196608:cALE6dWjWnulUCK9vDfaa1RkYP60bs25rXSNBl66Wncma:a6fuiPrfZ1RBP60bs25rXQ66WnG","ssdeep_chunks":["196608:cALE6dW","196608:ALE6dWj","196608:LE6dWjW","196608:E6dWjWn","196608:6dWjWnu","196608:dWjWnul","196608:WjWnulU","196608:jWnulUC","196608:WnulUCK","196608:nulUCK9","196608:ulUCK9v","196608:lUCK9vD","196608:UCK9vDf","196608:CK9vDfa","196608:K9vDfaa","196608:9vDfaa1","196608:vDfaa1R","196608:Dfaa1Rk","196608:faa1RkY","196608:aa1RkYP","196608:a1RkYP6","196608:1RkYP60","196608:RkYP60b","196608:kYP60bs","196608:YP60bs2","196608:P60bs25","196608:60bs25r","196608:0bs25rX","196608:bs25rXS","196608:s25rXSN","196608:25rXSNB","196608:5rXSNBl","196608:rXSNBl6","196608:XSNBl66","196608:SNBl66W","196608:NBl66Wn","196608:Bl66Wnc","196608:l66Wncm","196608:66Wncma","393216:cALE6dW","393216:ALE6dWj","393216:LE6dWjW","393216:E6dWjWn","393216:6dWjWnu","393216:dWjWnul","393216:WjWnulU","393216:jWnulUC","393216:WnulUCK","393216:nulUCK9","393216:ulUCK9v","393216:lUCK9vD","393216:UCK9vDf","393216:CK9vDfa","393216:K9vDfaa","393216:9vDfaa1","393216:vDfaa1R","393216:Dfaa1Rk","393216:faa1RkY","393216:aa1RkYP","393216:a1RkYP6","393216:1RkYP60","393216:RkYP60b","393216:kYP60bs","393216:YP60bs2","393216:P60bs25","393216:60bs25r","393216:0bs25rX","393216:bs25rXS","393216:s25rXSN","393216:25rXSNB","393216:5rXSNBl","393216:rXSNBl6","393216:XSNBl66","393216:SNBl66W","393216:NBl66Wn","393216:Bl66Wnc","393216:l66Wncm","393216:66Wncma","196608:a6fuiPr","196608:6fuiPrf","196608:fuiPrfZ","196608:uiPrfZ1","196608:iPrfZ1R","196608:PrfZ1RB","196608:rfZ1RBP","196608:fZ1RBP6","196608:Z1RBP60","196608:1RBP60b","196608:RBP60bs","196608:BP60bs2","196608:bs25rXQ","196608:s25rXQ6","196608:25rXQ66","196608:5rXQ66W","196608:rXQ66Wn","196608:XQ66WnG"],"imphash":"be41bf7b8cc010b614bd36bbca606973","pehash":"813f37f3dc2ac33146521811d7fdba04c998505d"},"file_info":{"file_name":"a67e34baacfca98f323981d3b0087f3b.exe","file_type":["peexe","autoit","executable"],"file_type_id":"autoit","file_size":7284070,"entropy":8,"compile_timestamp":"2012-02-24T19:20:04","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1733473818000,"last_seen":1788132975000,"last_multi_scan":1788132975000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"embedded_file_count":9,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":29324,"raw_size":29696},{"name":".rdata","virtual_address":"0x9000","virtual_size":11118,"raw_size":11264},{"name":".data","virtual_address":"0xc000","virtual_size":469916,"raw_size":512},{"name":".ndata","virtual_address":"0x7f000","virtual_size":528384},{"name":".rsrc","virtual_address":"0x100000","virtual_size":134838,"raw_size":135168},{"name":".reloc","virtual_address":"0x121000","virtual_size":4054,"raw_size":4096}],"section_names":[".text",".rdata",".data",".ndata",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","wacatac","rat","quasar","opensource","targeted","criminal","trojan","evasive","RAT"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":111},"sandbox_signatures":{"informative_count":285,"suspicious_count":11,"malicious_count":11,"total":307},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"InfoStealer/Win.LummaC2.XG97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.75079668","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.75079668 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.NSIS.CD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Backdoor ( 005cdde81 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.HFHN-5645","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"CypherIt","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Able to monitor clipboard data (API string)"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to copy files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"},{"type":"informative","value":"Contains ability to register hotkeys"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decompress files using PowerShell"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"suspicious","value":"Contains ability to empty the Recycle Bin on the specified drive"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Contains ability to block user input"},{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"References Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"},{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory: \"%s\" created\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory: can't create \"%s\" - a file already exists\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory: can't create \"%s\" (err=%d)\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory: \"%s\" (%d)\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RMDir: RemoveDirectory(\"%s\")\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"Delete: DeleteFile on Reboot(\"%s\")\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"Delete: DeleteFile failed(\"%s\")\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"RMDir: RemoveDirectory invalid input(\"%s\")\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"RMDir: RemoveDirectory failed(\"%s\")\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"RMDir: RemoveDirectory on Reboot(\"%s\")\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"Delete: DeleteFile(\"%s\")\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributes failed.\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"SetFileAttributes: \"%s\":%08X\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"sample.bin\"), Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"EnumProcesses\" (Indicator: \"EnumProcesses\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; Source: \"sample.bin\"), Found reference to API \"EnumProcessModules\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\"), Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/nsis_error\", Heuristic match: \"u~.it\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"ApolloPro.scr\" called \"FindResourceW\" with parameter \"200\" - (UID: 00000000-00000836)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevs\" (Indicator: \"SetupDiGetClassDevs\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"SetupDiGetDeviceRegistryProperty\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003312.00000001.84488.00870000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003312.00000001.84488.009B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003312.00000001.84488.009D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003312.00000001.84488.009E0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003312.00000001.84488.009F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003312.00000002.86411.00C70000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003312.00000002.86411.00DE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003312.00000002.86411.00E30000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - ^(?([0-9A-Fa-f]{32}))_(?(\\d+(?:\\.\\d+)+))$; Source: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 6F960000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"RegAsm.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"cmd.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005856-59327-49-00E4A385\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005856-59327-1259-00E4A354","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00003312.00000001.84488.00EA0000.00000004.mdmp, 00000000-00003312.00000002.86411.00EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2c","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContext\" (Indicator: \"CryptAcquireContext\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003312.00000001.84488.01070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000836.00000001.82091.007B3000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99905","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"b__1_0\" (Indicator: \"GetLogicalDrives\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003312-00000C2C-314158625\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003312-00000C2C-321095205\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00005560-00000C47-11726922846\")\n Found string \"findstr /I \"wrsa opssvc\"\" (Source: \"00000000-00005560-00000C47-11726922846\")\n Found string \"findstr \"AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth\"\" (Source: \"00000000-00005560-00000C47-13371682194\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"RegAsm.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003312-00000C2C-314158625\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003312-00000C2C-321095205\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \"SetCreationTime\" (Indicator: \"setcreationtime\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cdn-downloads.com/cookies_script.py\" (Indicator: \"/cookies\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevs\" (Indicator: \"setupdigetclassdevs\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"SetupDiGetDeviceRegistryProperty\" (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"RegAsm.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00003312)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005384)\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005384)\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005384)\n \"Dr.com\" called \"GetForegroundWindow\" (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"IsWow64Process\" with parameter \"5384\" - (UID: 00000000-00005384)\n \"tasklist.exe\" called \"IsWow64Process\" with parameter \"5488\" - (UID: 00000000-00005488)\n \"findstr.exe\" called \"IsWow64Process\" with parameter \"5740\" - (UID: 00000000-00005740)\n \"tasklist.exe\" called \"IsWow64Process\" with parameter \"5460\" - (UID: 00000000-00005460)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Dr.com\" called \"EnumWindows\" with parameter \"15627520\" - (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Dr.com\" called \"GetWindowTextW\" (UID: 00000000-00005856)\n \"Dr.com\" called \"GetWindowTextW\" with parameter \"Network Flyout\" - (UID: 00000000-00005856)\n \"Dr.com\" called \"GetWindowTextW\" with parameter \"Task Switching\" - (UID: 00000000-00005856)\n \"Dr.com\" called \"GetWindowTextW\" with parameter \"CiceroUIWndFrame\" - (UID: 00000000-00005856)\n \"Dr.com\" called \"GetWindowTextW\" with parameter \"Start\" - (UID: 00000000-00005856)\n \"Dr.com\" called \"GetWindowTextW\" with parameter \"Start menu\" - (UID: 00000000-00005856)\n \"Dr.com\" called \"GetWindowTextW\" with parameter \"TF_FloatingLangBar_WndTitle\" - (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"GetActiveWindow\" (UID: 00000000-00005384)\n \"Dr.com\" called \"GetActiveWindow\" (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005384)\n \"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005488)\n \"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005460)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005752)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006008)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003892)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005384)\n \"Dr.com\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"$35","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005384)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005488)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005460)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00005856-59327-1058-00E2E00D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00005856-59327-1158-00E8494A\n FindFirstFileW@KERNEL32.DLL at 00000000-00005856-59327-1563-00E83CE2\n FindFirstFileW@KERNEL32.DLL at 00000000-00005856-59327-1569-00E84005\n FindFirstFileW@KERNEL32.DLL at 00000000-00005856-59327-1637-00E8FA36\n FindFirstFileW@KERNEL32.DLL at 00000000-00005856-59327-1660-00E8C2FF\n FindNextFileW@KERNEL32.DLL at 00000000-00005856-59327-1661-00E8C4A3\n FindFirstFileW@KERNEL32.DLL at 00000000-00005856-59327-1670-00E8CD14\n FindFirstFileW@KERNEL32.DLL at 00000000-00005856-59327-1671-00E8CD9F\n FindNextFileW@KERNEL32.DLL at 00000000-00005856-59327-1684-00E8F5D8\n FindNextFileW@KERNEL32.DLL at 00000000-00005856-59327-1688-00E8F735","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00005856-59327-1633-00E8A995\n GetDriveTypeW@KERNEL32.DLL at 00000000-00005856-59327-1641-00E8AEEA\n GetDriveTypeW@KERNEL32.DLL at 00000000-00005856-59327-1645-00E8B353","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_LogonSession\" (Indicator: \"select * from \"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found string \"Select * from Win32_PnPEntity\" (Indicator: \"select * from \"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005856-59327-503-00E4542A\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005856-59327-1290-00E550B7\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00005856-59327-1671-00E8CD9F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00005856-59327-434-00E27B3F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005856-59327-503-00E4542A\n GetLocalTime@KERNEL32.DLL at 00000000-00005856-59327-879-00E85BB8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005856-59327-1290-00E550B7\n GetLocalTime@KERNEL32.DLL at 00000000-00005856-59327-1687-00E8E25D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005856-59327-444-00E5416A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00005856-59327-1191-00E35D13","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00005856-59327-1650-00E8B976\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00005856-59327-1651-00E8BA3E\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00005856-59327-1652-00E8BB06","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$36","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; File: \"Audit.cmd\")\n Found string \"set cd door\" (Indicator: \"set \"; File: \"00000000-00005856.00000001.78323.00E21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00005856-59327-1191-00E35D13","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayoutNameW@USER32.DLL at 00000000-00005856-59327-434-00E27B3F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$38","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 00E5436Eh\" at 00000000-00005856-59327-444-00E5416A\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp word ptr [esi], 0000h\" and \"je 00E85D30h\" at 00000000-00005856-59327-879-00E85BB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"Dr.com\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"Dr.com\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"ApolloPro.scr\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"ApolloPro.scr\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Dr.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ApolloPro.scr\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RegAsm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"RegAsm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"t * From Win32_Process Where ParentProcessID=\" (Indicator: \" Win32_Process\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Able to decompress files using PowerShell","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":3,"id":"string-825","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00005560)\n \"RegAsm.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134321335144742251.3312.DefaultAppDomain.RegAsm\" - (UID: 00000000-00003312)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"RegAsm.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00003312.00000000.82668.00812000.00000020.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003312.00000000.82668.00812000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.74.38.211:4782\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"RegAsm.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_LogonSession\" (Source: 00003312.00000CF0.99729604.002C0000.wprm, Indicator: \"select * from win32_logonsession\")\n \"Select * from Win32_PnPEntity\" (Source: 00003312.00000CF0.99729604.002C0000.wprm, Indicator: \"select * from win32_pnpentity\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to copy files","description":"Observed string: \"\"%WINDIR%\\System32\\cmd.exe\" /c copy Audit Audit.cmd && Audit.cmd\" (Indicator: \"/c copy \") in Source: 00000000-00005384-00000C47-10763475510\n Observed string: \"/c copy Audit Audit.cmd && Audit.cmd\" (Indicator: \"/c copy \") in Source: 00000000-00005384-00000C77-10765268606\n Observed string: \"cmd /c copy /b ..\\Dentists + ..\\Flavor + ..\\Disturbed + ..\\Artistic + ..\\Justice + ..\\Proceeds + ..\\Zip + ..\\Soundtrack + ..\\Reve\" (Indicator: \"/c copy \") in Source: 00000000-00005560-00000C47-19490657130\n Observed string: \"cmd /c copy /b ..\\Dentists + ..\\Flavor + ..\\Disturbed + ..\\Artistic + ..\\Justice + ..\\Proceeds + ..\\Zip + ..\\Soundtrack + ..\\Revenue B\" (Indicator: \"/c copy \") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005856-59327-51-00E55CAC\n LoadLibraryA@KERNEL32.DLL at 00000000-00005856-59327-507-00E9C6D9\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005856-59327-883-00EABE70\n LoadLibraryW@KERNEL32.DLL at 00000000-00005856-59327-885-00EA6A0C\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005856-59327-1148-00E349C2\n LoadLibraryA@KERNEL32.DLL at 00000000-00005856-59327-1150-00E34BAA\n LoadLibraryA@KERNEL32.DLL at 00000000-00005856-59327-1152-00E34B77\n LoadLibraryA@KERNEL32.DLL at 00000000-00005856-59327-1192-00E355F0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005856-59327-1228-00E4428E\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005856-59327-1232-00E441B9\n LoadLibraryA@KERNEL32.DLL at 00000000-00005856-59327-1978-00E997CA\n LoadLibraryW@KERNEL32.DLL at 00000000-00005856-59327-1988-00E9DFB1\n LoadLibraryW@KERNEL32.DLL at 00000000-00005856-59327-2001-00E9EB20\n LoadLibraryA@KERNEL32.DLL at 00000000-00005856-59327-2033-00EA1447","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.DLL at 00000000-00005856-59327-932-00E2AD98\n RegisterHotKey@USER32.DLL at 00000000-00005856-59327-1054-00E2DD6D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.009","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService\" (Indicator: \"StartService\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\7a9c0f279c464958aebbd585f20f1cf2\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"RegAsm.exe\" as clean (type is \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\"), Antivirus vendors marked dropped file \"Artistic\" as clean (type is \"DOS executable (COM) maybe with interrupt 22h start instruction 0x8cdc8456 cd5761f7\"), Antivirus vendors marked dropped file \"ApolloPro.scr\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"Commissioner\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"RegAsm.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134321335144742251.3312.DefaultAppDomain.RegAsm","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77680000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77680000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6A370000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63590000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74EC0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74EC0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74A80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 641F0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 649A0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"Dr.com\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"choice.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"ApolloPro.scr\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77140000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1b001c00664f8b76@propsys.dll\"\n \"1800190018478b76@propsys.dll\"\n \"1700180034478b76@propsys.dll\"\n \"16001700ae478b76@propsys.dll\"\n \"1500160020732c72@ADVAPI32.dll\"\n \"0e000f00e4732c72@ADVAPI32.dll\"\n \"0e000f0050742c72@ADVAPI32.dll\"\n \"11001200d47d2c72@ADVAPI32.dll\"\n \"110012007c7e2c72@ADVAPI32.dll\"\n \"12001300cc7e2c72@ADVAPI32.dll\"\n \"12001300387f2c72@ADVAPI32.dll\"\n \"14001500e4b72c72@ADVAPI32.dll\"\n \"1400150000b82c72@ADVAPI32.dll\"\n \"140015001cb82c72@ADVAPI32.dll\"\n \"1700180038b82c72@ADVAPI32.dll\"\n \"0d000e0054b82c72@ADVAPI32.dll\"\n \"1100120064b82c72@ADVAPI32.dll\"\n \"110012007cb82c72@ADVAPI32.dll\"\n \"0d000e009c7f2c72@SHELL32.dll\"\n \"0d000e0028802c72@SHELL32.dll\"\n \"0f001000ecb92c72@ADVAPI32.dll\"\n \"1400150038ba2c72@ADVAPI32.dll\"\n \"1400150054ba2c72@ADVAPI32.dll\"\n \"0c000d00a8ba2c72@ADVAPI32.dll\"\n \"0c000d00b8ba2c72@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$46","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00005384-00000C47-10763475510]\n Observed system executable string:\"\"%WINDIR%\\System32\\cmd.exe\" /c copy Audit Audit.cmd && Audit.cmd\" [Source: 00000000-00005384-00000C47-10763475510]\n Observed system executable string:\"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00005560-00000C47-9404828696]\n Observed system executable string:\"%WINDIR%\\system32\\findstr.exe\" [Source: 00000000-00005560-00000C47-11726922846]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005560-00000C47-17995059666]\n Observed system executable string:\"%WINDIR%\\system32\\choice.exe\" [Source: 00000000-00005560-00000C47-24297161326]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" [Source: 00000000-00005856-00000C2E-226351063356]\n Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00005752-00000C2B-210803900]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"RegAsm.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$48","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \"WLDAP32.dll\" (Source: \"00000000-00003312.00000002.86411.00A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Dr.com\" searching for class \"Shell_TrayWnd\"\n \"ApolloPro.scr\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4c","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"cmd.exe\" with commandline \"/c copy Audit Audit.cmd && Audit.cmd\" (UID: 00000000-00005560)\n Process \"cmd.exe\" with commandline \"cmd /c copy /b ..\\\\Dentists + ..\\\\Flavor + ..\\\\Disturbed + ..\\\\Artistic + ..\\\\Justice + ..\\\\Proceeds + ..\\\\Zip + ..\\\\Soundtrack + ..\\\\Revenue B\" (UID: 00000000-00005800)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Dr.com\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"RegAsm.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Commissioner\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Calls an API typically used to set the date and time of the file","description":"\"cmd.exe\" called \"SetFileTime\" (UID: 00000000-00005560)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":2,"id":"api-205","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" connecting to \"\\ThemeApiPort\"\n \"Dr.com\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"ApolloPro.scr\" connecting to \"\\ThemeApiPort\"\n \"RegAsm.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00005856-59327-434-00E27B3F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"ApolloPro.scr\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 836)\n \"ApolloPro.scr\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 1184)\n \"RegAsm.exe\" queries basic process information of the \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll\" (UID: 3312)\n \"RegAsm.exe\" queries basic process information of the \"C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\" (UID: 3312)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" reads file \"c:\\6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"RegisterTaskDefinition\" (Indicator: \"RegisterTask\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"RegisterTaskDefinition\" (Indicator: \"RegisterTaskDefinition\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$50","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" touched file \"C:\\Windows\\MovieArchives\"\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" touched file \"C:\\Windows\\PackageExpression\"\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"RegAsm.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"\n \"RegAsm.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\commissioner\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"file/memory contains long string with (Indicator: \"ping -\"; File: \"Audit.cmd\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"file/memory contains long string with (Indicator: \"HttpWebRequest\"; File: \"RegAsm.exe\")\n Found string \"SystemNetHttpWebRequest\" (Indicator: \"HttpWebRequest\"; File: \"00000000-00003312.00000000.82668.00812000.00000020.mdmp\")\n Found string \"SystemNetHttpWebRequest\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00003312.00000000.82668.00812000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005488)\n \"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005460)\n \"RegAsm.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003312)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"RegAsm.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"56b8228\"\n \"lpszHeaders\": \"If-None-Match: \\\"084627641cfd61:0\\\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"RegAsm.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"56ab520\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"RegAsm.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"56b8228\"\n \"lpReserved\": \"0\"}\n \"RegAsm.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"56ab520\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$59","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00003312\"\n YARA signature for RSA public and private key matched on file \"RegAsm.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktop\" (Indicator: \"CreateDesktop\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00005856.00000001.78323.00E21000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00005856.00000001.78323.00E21000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"file/memory contains long string(File: \"RegAsm.exe\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEEF7BD3E553034BD8B861C3F7B108]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003312.00000001.84488.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.00A00000.00000004.mdmp, 00000000-00003312.00000002.86411.055E0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00003312.00000001.84488.00E40000.00000004.mdmp, 00000000-00003312.00000002.86411.00E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"componenthashtableentry\" (Indicator: \"nthash\"; Source: \"00000000-00003312.00000001.84488.00EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found string \"GetClipboardData\" (File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found string \"GetClipboardData\" (Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"850280,1228,3024,,RtlGetVersion,NTDLL.dll,\"687:22:00.391\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003312.00000001.84488.02130000.00000004.mdmp, 00000000-00003312.00000002.86411.02130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"b__1_0\" (Indicator: \"GetLogicalDrives\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" tries to directly access volume data \"C:\"\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" tries to directly access volume data \"Z:\"\n \"RegAsm.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 732E0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Dr.com\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00005560-00000C47-9404828696]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00003312.00000001.84488.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"00000000-00005856.00000001.78323.00E21000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"findstr /I \"wrsa opssvc\"\" (Indicator: \"findstr \"; Source: \"00000000-00005560-00000C47-11726922846\")\n Found string \"findstr \"AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth\"\" (Indicator: \"findstr \"; Source: \"00000000-00005560-00000C47-13371682194\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00003312.00000CF0.99729604.002C0000.wprm","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /I \"wrsa opssvc\"\" (UID: 00000000-00005740)\n Process \"findstr.exe\" with commandline \"findstr \"AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth\"\" (UID: 00000000-00005492)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"Y_CURRENT_USER\\Software\\FTPWare\\COREFTP\\Sites\\\" (Indicator: \"software\\ftpware\\coreftp\\sites\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00005488), \"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00005460)\n \"RegAsm.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\2e76676fbd265f70be92c82bbf76b8e5\\System.DirectoryServices.ni.dll\" (UID: 00000000-00003312)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$60","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; File: \"00003312.00000CF0.99729604.002C0000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00003312.00000CF0.99729604.002C0000.wprm\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00000836.00000000.80632.000F0000.00000002.mdmp\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00001320.00000000.84620.000F0000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003312.00000001.84488.00870000.00000004.mdmp\n 00000000-00003312.00000001.84488.009D0000.00000004.mdmp\n 00000000-00003312.00000001.84488.00A00000.00000004.mdmp\n 00000000-00003312.00000002.86411.00A00000.00000004.mdmp\n 00000000-00003312.00000002.86411.00C70000.00000004.mdmp\n 00000000-00003312.00000002.86411.00DE0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00000836.00000000.80632.000F0000.00000002.mdmp\")\n Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00001320.00000000.84620.000F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Dr.com\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"ApolloPro.scr\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"RegAsm.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"Dr.com\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"ApolloPro.scr\" opened \"\\Device\\KsecDD\"\n \"RegAsm.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$62","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"RegAsm.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"RegAsm.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"RegAsm.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Dr.com\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\491505\\Dr.com]- [targetUID: 00000000-00005560]\n \"RegAsm.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\491505\\RegAsm.exe]- [targetUID: 00000000-00005856]\n \"Artistic\" has type \"DOS executable (COM) maybe with interrupt 22h start instruction 0x8cdc8456 cd5761f7\"- Location: [%TEMP%\\Artistic]- [targetUID: 00000000-00005384]\n \"Commissioner\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\Commissioner]- [targetUID: 00000000-00005384]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"B has high entropy\"\n \"Dentists has high entropy\"\n \"Disturbed has high entropy\"\n \"Proceeds has high entropy\"\n \"Zip has high entropy\"\n \"Flavor has high entropy\"\n \"Soundtrack has high entropy\"\n \"3130B1871A126520A8C47861EFE3ED4D has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$63","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SHAutoComplete\" (Source: 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706, API is part of module: SHLWAPI.DLL)\n Found string \"GetUserDefaultUILanguage\" (Source: 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706, API is part of module: KERNELBASE.DLL)\n Found string \"RegDeleteKeyExW\" (Source: 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706, API is part of module: ADVAPI32.DLL)\n Found string \"MoveFileExW\" (Source: 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706, API is part of module: KERNEL32.DLL)\n Found string \"Module32NextW\" (Source: 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706, API is part of module: KERNEL32.DLL)\n Found string \"Module32FirstW\" (Source: 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706, API is part of module: KERNEL32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Dr.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"ApolloPro.scr\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"RegAsm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.DLL at 00000000-00005856-59327-1882-00E945D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1562.001","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/26 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00005856-59327-757-00E89ED8\n FindResourceW@KERNEL32.DLL at 00000000-00005856-59327-1573-00E8443D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Dr.com\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\491505\\Dr.com]- [targetUID: 00000000-00005560]\n \"RegAsm.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\491505\\RegAsm.exe]- [targetUID: 00000000-00005856]\n \"Artistic\" has type \"DOS executable (COM) maybe with interrupt 22h start instruction 0x8cdc8456 cd5761f7\"- Location: [%TEMP%\\Artistic]- [targetUID: 00000000-00005384]\n \"ApolloPro.scr\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr]- [targetUID: 00000000-00005856]\n \"Commissioner\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\Commissioner]- [targetUID: 00000000-00005384]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$64","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to empty the Recycle Bin on the specified drive","description":"SHEmptyRecycleBinW@SHELL32.DLL at 00000000-00005856-59327-1680-00E8DB6F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":3,"id":"stream-114","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00005856-59327-858-00E22BA9\n SystemParametersInfoW@USER32.DLL at 00000000-00005856-59327-1193-00E35F00\n SystemParametersInfoW@USER32.DLL at 00000000-00005856-59327-1194-00E35F8B\n SystemParametersInfoW@USER32.DLL at 00000000-00005856-59327-1933-00E97B95","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsxECAF.tmp\" for deletion\n \"Dr.com\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\491505\\B\" for deletion\n \"RegAsm.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1gadodqr.fxm.ps1\" for deletion\n \"RegAsm.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fbfmkcjs.loj.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsxECAF.tmp\" with delete access\n \"Dr.com\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\491505\\B\" with delete access\n \"RegAsm.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1gadodqr.fxm.ps1\" with delete access\n \"RegAsm.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fbfmkcjs.loj.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"RegAsm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"RegAsm.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Dr.com\" called \"CreateProcessW\" with parameter \"%TEMP%\\491505\\RegAsm.exe\" - (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"Dr.com\" called \"CreateProcessW\" with parameter \"%TEMP%\\491505\\RegAsm.exe\" - (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00005488)\n Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00005460)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 2071 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe\" called \"ShellExecuteW\" with parameter cmd (UID: 00000000-00005384)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/create /tn \"ApolloPro\" /tr \"wscript //B '%LOCALAPPDATA%\\\\CreativePixel Tech\\\\ApolloPro.js'\" /sc onlogon /F /RL HIGHEST\" (UID: 00000000-00005752)\n Process \"schtasks.exe\" with commandline \"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\\\CreativePixel Tech\\\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST\" (UID: 00000000-00006008)\n Process \"schtasks.exe\" with commandline \"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\\\CreativePixel Tech\\\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST\" (UID: 00000000-00003892)\n Process \"schtasks.exe\" with commandline \"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\\\CreativePixel Tech\\\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST\" (UID: 00000000-00002164)\n Process \"schtasks.exe\" with commandline \"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\\\CreativePixel Tech\\\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST\" (UID: 00000000-00003948)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 45.74.38.211 on port 4782","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – Orcus RAT","description":"YARA signature match – Orcus RAT process \"00000000-00003312\"","origin":"YARA Signature","relevance":10,"id":"yara-635","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – Orcus RAT","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5027","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Spyware","details_count":6,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Attempts to search for AV-related strings in a file"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"intel_graph":{"map":{"Domain:662f1a2834dd016a3c134e52c512e691c5a776913cec5a427ebe760f9ee9830a":{"type":"Domain","value":"UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY","verdict":{"verdict":"unknown"}},"File:0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d":{"type":"File","value":"0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d"},"File:053fa327193f853ee22d3432eda54a3145be9de2a7233303b74f7e0629ed8e16":{"type":"File","value":"053fa327193f853ee22d3432eda54a3145be9de2a7233303b74f7e0629ed8e16","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:0cda78e14e47e67ebe6f17a5b52c2c7439b225626f9737b79b0f4e08f538d6c1":{"type":"File","value":"0cda78e14e47e67ebe6f17a5b52c2c7439b225626f9737b79b0f4e08f538d6c1","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac":{"type":"File","value":"0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac"},"File:122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7":{"type":"File","value":"122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat CypherIt","confirmed relationship with a Threat"]},"filetype":"data (from detonation dropped)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:166329a1ba8f47105e5dd736135769b9633e85b6d90cd137896375e116d60680":{"type":"File","value":"166329a1ba8f47105e5dd736135769b9633e85b6d90cd137896375e116d60680","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:1ce724664d2fabb93635a31d0f1cf768ecc21c9e01d0cdfb9303d7898522bafa":{"type":"File","value":"1ce724664d2fabb93635a31d0f1cf768ecc21c9e01d0cdfb9303d7898522bafa","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 48x48","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:1d9ee082745c4577a90f191c9f4e2aede0bdb6212254852bbbb56ebbd62ef81b":{"type":"File","value":"1d9ee082745c4577a90f191c9f4e2aede0bdb6212254852bbbb56ebbd62ef81b"},"File:220cd2db215dcb3c5d9f14a90462360ac7202b3da9461a1f721be8aba966e97b":{"type":"File","value":"220cd2db215dcb3c5d9f14a90462360ac7202b3da9461a1f721be8aba966e97b","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat CypherIt","confirmed relationship with a Threat"]},"filetype":"ASCII text, with very long lines (1227)","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147":{"type":"File","value":"226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147"},"File:4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9":{"type":"File","value":"4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9"},"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706":{"type":"File","value":"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates scheduled task using schtasks.exe","Detected relationship with a Threat CypherIt","PE file has invalid certificate","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat CypherIt"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:65af7b430d580514205c0f6a8ee051a2026f25cfe1a72ecc063f3d9eea96b36f":{"type":"File","value":"65af7b430d580514205c0f6a8ee051a2026f25cfe1a72ecc063f3d9eea96b36f","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2":{"type":"File","value":"70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2"},"File:865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4":{"type":"File","value":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4"},"File:8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df":{"type":"File","value":"8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df"},"File:93a37b597dc9a58eaec788ba151d80deb19c1ed4a2ae37a4d631dbac00ef36ae":{"type":"File","value":"93a37b597dc9a58eaec788ba151d80deb19c1ed4a2ae37a4d631dbac00ef36ae","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-shockwave-flash"},"File:9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60":{"type":"File","value":"9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60"},"File:a4f25ba127d1e1607df4027f2e99bfef3d4e176f393179fd07c07cfecf71871c":{"type":"File","value":"a4f25ba127d1e1607df4027f2e99bfef3d4e176f393179fd07c07cfecf71871c"},"File:ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e":{"type":"File","value":"ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e"},"File:b6f757bc180626f436890e5caa121881b5a74dea8262ea8230f645efe18bb387":{"type":"File","value":"b6f757bc180626f436890e5caa121881b5a74dea8262ea8230f645efe18bb387","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:c34f39a233844c727914156102e817ce78969051b7021ebabb5e741f5455625d":{"type":"File","value":"c34f39a233844c727914156102e817ce78969051b7021ebabb5e741f5455625d"},"File:c56f910b6057a45fbe5062083358ecddf9e603cdb2f2152a95fe80bdc22a4461":{"type":"File","value":"c56f910b6057a45fbe5062083358ecddf9e603cdb2f2152a95fe80bdc22a4461","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961":{"type":"File","value":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961"},"File:d5cfd52f4656f16c72416be89ef21aeff65cff0890c8f762b8d94b05aff1c27d":{"type":"File","value":"d5cfd52f4656f16c72416be89ef21aeff65cff0890c8f762b8d94b05aff1c27d"},"File:de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037":{"type":"File","value":"de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037"},"File:fdc00da53bb37010a555a271ef9ed67ec8515ee6d8c1e9d4fd0400bb9d576565":{"type":"File","value":"fdc00da53bb37010a555a271ef9ed67ec8515ee6d8c1e9d4fd0400bb9d576565","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"Ip:45.74.38.211":{"type":"Ip","value":"45.74.38.211"},"Threat:8fe718a2dc44927191288cabe04b1f42557b00434395ce7c618af542203d790e":{"type":"Threat","value":"CypherIt","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat CypherIt","confirmed relationship with a Threat"]}}},"chains":[{"id":"1543766433069247832","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates scheduled task using schtasks.exe","Detected relationship with a Threat CypherIt","PE file has invalid certificate","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat CypherIt"]}},{"id":"1543766422901316771","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"contacted_domain","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"Domain:662f1a2834dd016a3c134e52c512e691c5a776913cec5a427ebe760f9ee9830a"}],"verdict":{"verdict":"unknown"}},{"id":"1543766422901316769","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:053fa327193f853ee22d3432eda54a3145be9de2a7233303b74f7e0629ed8e16"}],"verdict":{"verdict":"unknown"}},{"id":"1543766422897122459","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:0cda78e14e47e67ebe6f17a5b52c2c7439b225626f9737b79b0f4e08f538d6c1"}],"verdict":{"verdict":"unknown"}},{"id":"1543766422905511080","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:166329a1ba8f47105e5dd736135769b9633e85b6d90cd137896375e116d60680"}],"verdict":{"verdict":"unknown"}},{"id":"1543766423341718706","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:1ce724664d2fabb93635a31d0f1cf768ecc21c9e01d0cdfb9303d7898522bafa"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543766422905511081","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:65af7b430d580514205c0f6a8ee051a2026f25cfe1a72ecc063f3d9eea96b36f"}],"verdict":{"verdict":"unknown"}},{"id":"1543766422897122462","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:93a37b597dc9a58eaec788ba151d80deb19c1ed4a2ae37a4d631dbac00ef36ae"}],"verdict":{"verdict":"unknown"}},{"id":"1543766422901316774","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:b6f757bc180626f436890e5caa121881b5a74dea8262ea8230f645efe18bb387"}],"verdict":{"verdict":"unknown"}},{"id":"1543766422897122464","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:c56f910b6057a45fbe5062083358ecddf9e603cdb2f2152a95fe80bdc22a4461"}],"verdict":{"verdict":"unknown"}},{"id":"1543766422901316772","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:fdc00da53bb37010a555a271ef9ed67ec8515ee6d8c1e9d4fd0400bb9d576565"}],"verdict":{"verdict":"unknown"}},{"id":"1543766446951397206","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"Threat:8fe718a2dc44927191288cabe04b1f42557b00434395ce7c618af542203d790e"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat"]}},{"id":"1543766422905511082","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"dropped","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7"},{"edge_kind":"extracted","from_key":"File:122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7","to_key":"File:220cd2db215dcb3c5d9f14a90462360ac7202b3da9461a1f721be8aba966e97b"},{"edge_kind":"is_threat","from_key":"File:220cd2db215dcb3c5d9f14a90462360ac7202b3da9461a1f721be8aba966e97b","to_key":"Threat:8fe718a2dc44927191288cabe04b1f42557b00434395ce7c618af542203d790e"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"sandbox_network","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"contacted_ip","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"Ip:45.74.38.211"},{"edge_kind":"contacted_domain","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"Domain:662f1a2834dd016a3c134e52c512e691c5a776913cec5a427ebe760f9ee9830a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","edges":[{"edge_kind":"dropped","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:053fa327193f853ee22d3432eda54a3145be9de2a7233303b74f7e0629ed8e16"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:fdc00da53bb37010a555a271ef9ed67ec8515ee6d8c1e9d4fd0400bb9d576565"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:c56f910b6057a45fbe5062083358ecddf9e603cdb2f2152a95fe80bdc22a4461"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:65af7b430d580514205c0f6a8ee051a2026f25cfe1a72ecc063f3d9eea96b36f"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:1ce724664d2fabb93635a31d0f1cf768ecc21c9e01d0cdfb9303d7898522bafa"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:166329a1ba8f47105e5dd736135769b9633e85b6d90cd137896375e116d60680"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:b6f757bc180626f436890e5caa121881b5a74dea8262ea8230f645efe18bb387"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:220cd2db215dcb3c5d9f14a90462360ac7202b3da9461a1f721be8aba966e97b"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:93a37b597dc9a58eaec788ba151d80deb19c1ed4a2ae37a4d631dbac00ef36ae"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:0cda78e14e47e67ebe6f17a5b52c2c7439b225626f9737b79b0f4e08f538d6c1"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:d5cfd52f4656f16c72416be89ef21aeff65cff0890c8f762b8d94b05aff1c27d"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:c34f39a233844c727914156102e817ce78969051b7021ebabb5e741f5455625d"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:a4f25ba127d1e1607df4027f2e99bfef3d4e176f393179fd07c07cfecf71871c"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:1d9ee082745c4577a90f191c9f4e2aede0bdb6212254852bbbb56ebbd62ef81b"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d"},{"edge_kind":"extracted","from_key":"File:6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","to_key":"File:865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":29,"spawned_processes_count":29,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":181,"dropped_files_count":1,"extracted_files_count":28,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","wacatac","rat","quasar","opensource","targeted","criminal","trojan","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a8d823ea9131cfd3f0c3e7e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["GBR"],"submit_name":"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","analysis_start_time":"2026-08-25T11:53:36+00:00","indicators_count":{"informative":285,"suspicious":92,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.74.38.211","port":4782,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"dns_resolutions":[{"domain":"UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"http_requests":null,"embedded_domains":[{"value":"UWPunrsopYzTstryocRtyY.UWPunrsopYzTstryocRtyY","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}],"processes":[{"pid":5384,"ppid":0,"name":"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe","command_line":"","sha256":"6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706","normalized_path":"C:\\6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706.exe","uid":"00000000-00005384","icon":"$66"},{"pid":5560,"ppid":5384,"name":"cmd.exe","command_line":"/c copy Audit Audit.cmd && Audit.cmd","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00005384","uid":"00000000-00005560"},{"pid":5488,"ppid":5560,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00005560","uid":"00000000-00005488"},{"pid":5740,"ppid":5560,"name":"findstr.exe","command_line":"findstr /I \"wrsa opssvc\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00005560","uid":"00000000-00005740"},{"pid":5460,"ppid":5560,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00005560","uid":"00000000-00005460"},{"pid":5492,"ppid":5560,"name":"findstr.exe","command_line":"findstr \"AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00005560","uid":"00000000-00005492"},{"pid":5624,"ppid":5560,"name":"cmd.exe","command_line":"cmd /c md 491505","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005560","uid":"00000000-00005624"},{"pid":5800,"ppid":5560,"name":"cmd.exe","command_line":"cmd /c copy /b ..\\Dentists + ..\\Flavor + ..\\Disturbed + ..\\Artistic + ..\\Justice + ..\\Proceeds + ..\\Zip + ..\\Soundtrack + ..\\Revenue B","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00005560","uid":"00000000-00005800"},{"pid":5856,"ppid":5560,"name":"Dr.com","command_line":"B","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%TEMP%\\491505\\Dr.com","parent_uid":"00000000-00005560","uid":"00000000-00005856"},{"pid":5752,"ppid":5856,"name":"schtasks.exe","command_line":"/create /tn \"ApolloPro\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc onlogon /F /RL HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005856","uid":"00000000-00005752"},{"pid":3312,"ppid":5856,"name":"RegAsm.exe","command_line":"","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","normalized_path":"%TEMP%\\491505\\RegAsm.exe","parent_uid":"00000000-00005856","uid":"00000000-00003312"},{"pid":5784,"ppid":5560,"name":"choice.exe","command_line":"choice /d y /t 15","sha256":"4108605207ef00fcbbfe7ed7c3f96300601fb79f913d0e290538e8e02082cacc","normalized_path":"%WINDIR%\\system32\\choice.exe","parent_uid":"00000000-00005560","uid":"00000000-00005784"},{"pid":5604,"ppid":0,"name":"cmd.exe","command_line":"cmd /c schtasks.exe /create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00005604","icon":"$67"},{"pid":6008,"ppid":5604,"name":"schtasks.exe","command_line":"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00005604","uid":"00000000-00006008"},{"pid":836,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00000836","icon":"$68"},{"pid":1376,"ppid":0,"name":"cmd.exe","command_line":"cmd /c schtasks.exe /create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00001376","icon":"$69"},{"pid":3892,"ppid":1376,"name":"schtasks.exe","command_line":"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00001376","uid":"00000000-00003892"},{"pid":1184,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00001184","icon":"$6a"},{"pid":3368,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00003368","icon":"$6b"},{"pid":4340,"ppid":0,"name":"cmd.exe","command_line":"cmd /c schtasks.exe /create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00004340","icon":"$6c"},{"pid":2164,"ppid":4340,"name":"schtasks.exe","command_line":"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00004340","uid":"00000000-00002164"},{"pid":1320,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00001320","icon":"$6d"},{"pid":4512,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00004512","icon":"$6e"},{"pid":1928,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00001928","icon":"$6f"},{"pid":4960,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00004960","icon":"$70"},{"pid":924,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00000924","icon":"$71"},{"pid":2356,"ppid":0,"name":"cmd.exe","command_line":"cmd /c schtasks.exe /create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00002356","icon":"$72"},{"pid":3948,"ppid":2356,"name":"schtasks.exe","command_line":"/create /tn \"West\" /tr \"wscript //B '%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js'\" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002356","uid":"00000000-00003948"},{"pid":1540,"ppid":0,"name":"ApolloPro.scr","command_line":"\"%LOCALAPPDATA%\\CreativePixel Tech\\E\"","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","normalized_path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","uid":"00000000-00001540","icon":"$73"}],"all_imported_dlls":["dbghelp.dll","Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll","bcryptprimitives.dll","credssp.dll","comctl32.dll","apphelp.dll","urlmon.dll","mpr.dll","bcrypt.dll","Microsoft.Management.Infrastructure.ni.dll","wintrust.dll","System.Core.dll","user32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","ntmarta.dll","wininet.dll","imageres.dll","sfc_os.dll","Microsoft.PowerShell.Security.ni.dll","msvcrt.dll","ws2_32.dll","rsaenh.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Transactions.dll","pwrshsip.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","framedynos.dll","msasn1.dll","version.dll","winbrand.dll","wship6.dll","api-ms-win-core-timezone-l1-1-0.dll","mscoreei.dll","KernelBase.dll","api-ms-win-crt-filesystem-l1-1-0.dll","System.ni.dll","lpk.dll","clbcatq.dll","userenv.dll","cryptsp.dll","winrnr.dll","System.Management.Automation.ni.dll","System.Transactions.ni.dll","diasymreader.dll","cfgmgr32.dll","msacm32.dll","mscorlib.ni.dll","System.Numerics.ni.dll","System.Configuration.Install.dll","nlaapi.dll","dnsapi.dll","System.Configuration.ni.dll","System.Management.ni.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","cryptbase.dll","normaliz.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","fastprox.dll","wsock32.dll","rasadhlp.dll","ntdll.dll","msctf.dll","fltLib.dll","setupapi.dll","wmiutils.dll","System.Windows.Forms.ni.dll","WSHTCPIP.DLL","dhcpcsvc.dll","vcruntime140.dll","wbemcomn2.dll","ucrtbase_clr0400.dll","Microsoft.WSMan.Management.ni.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msvcp140.dll","api-ms-win-core-file-l1-2-0.dll","System.Core.ni.dll","System.Xml.ni.dll","System.Configuration.Install.ni.dll","msisip.dll","rpcrt4.dll","api-ms-win-crt-stdio-l1-1-0.dll","propsys.dll","samcli.dll","sfc.dll","FWPUCLNT.DLL","ole32.dll","api-ms-win-crt-string-l1-1-0.dll","ieframe.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","winmm.dll","taskschd.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","crypt32.dll","netutils.dll","comdlg32.dll","NapiNSP.dll","Microsoft.CSharp.ni.dll","gpapi.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Management.Automation.dll","System.Data.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll","webio.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wbemprox.dll","kernel32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","mscoree.dll","System.Drawing.ni.dll","System.DirectoryServices.ni.dll","System.Xml.dll","usp10.dll","advapi32.dll","VxSSL32.dll","dwmapi.dll","IPHLPAPI.DLL","System.dll","shell32.dll","ucrtbase.dll","api-ms-win-crt-time-l1-1-0.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","sechost.dll","api-ms-win-crt-convert-l1-1-0.dll","Wldap32.dll","secur32.dll","winsta.dll","winnsi.dll","Microsoft.PowerShell.Commands.Management.ni.dll","cryptnet.dll","gdi32.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","iertutil.dll","wkscli.dll","ktmw32.dll","clrjit.dll","ncrypt.dll","shlwapi.dll","imm32.dll","rpcss.dll","devobj.dll","pnrpnsp.dll","clr.dll","mscorrc.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","api-ms-win-crt-runtime-l1-1-0.dll","wshext.dll","api-ms-win-core-file-l2-1-0.dll","oleaut32.dll","uxtheme.dll","sspicli.dll","ntdsapi.dll","dhcpcsvc6.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","nsi.dll","profapi.dll","netapi32.dll","RpcRtRemote.dll","mswsock.dll","System.Data.dll","Microsoft.PowerShell.LocalAccounts.dll","AutoItX3.PowerShell.dll","api-ms-win-crt-math-l1-1-0.dll","winhttp.dll","shfolder.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","psapi.dll","xmllite.dll","AcGenral.dll","nlssorting.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","riched20.dll","wbemsvc.dll","vcruntime140_clr0400.dll","System.Windows.Forms.dll","SensApi.dll","srvcli.dll"]},"file_activity":{"dropped_files":[{"name":"122991768f589431_B","sha256":"122991768f589431b9166a4e22523bf48a53efff73fc2b191955e604196541b7","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]}],"extracted_files":[{"name":"CERTIFICATE","sha256":"053fa327193f853ee22d3432eda54a3145be9de2a7233303b74f7e0629ed8e16","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"fdc00da53bb37010a555a271ef9ed67ec8515ee6d8c1e9d4fd0400bb9d576565","sha256":"fdc00da53bb37010a555a271ef9ed67ec8515ee6d8c1e9d4fd0400bb9d576565","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".data","sha256":"c56f910b6057a45fbe5062083358ecddf9e603cdb2f2152a95fe80bdc22a4461","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[0]","sha256":"65af7b430d580514205c0f6a8ee051a2026f25cfe1a72ecc063f3d9eea96b36f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/4.ico","sha256":"1ce724664d2fabb93635a31d0f1cf768ecc21c9e01d0cdfb9303d7898522bafa","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rdata","sha256":"166329a1ba8f47105e5dd736135769b9633e85b6d90cd137896375e116d60680","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".reloc","sha256":"b6f757bc180626f436890e5caa121881b5a74dea8262ea8230f645efe18bb387","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"C:\\Users\\Administrator\\AppData\\Local\\AutoIt v3\\Aut2Exe\\autAAB.tmp.tok","sha256":"220cd2db215dcb3c5d9f14a90462360ac7202b3da9461a1f721be8aba966e97b","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":".text","sha256":"93a37b597dc9a58eaec788ba151d80deb19c1ed4a2ae37a4d631dbac00ef36ae","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[1]","sha256":"0cda78e14e47e67ebe6f17a5b52c2c7439b225626f9737b79b0f4e08f538d6c1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Audit.cmd","sha256":"0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"ApolloPro.scr","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"RegAsm.exe","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Artistic","sha256":"de1e4dbe18f0b926b49aceb10157bc7f542409bad6242422efef3b831608a037","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Commissioner","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"ApolloPro.js","sha256":"d5cfd52f4656f16c72416be89ef21aeff65cff0890c8f762b8d94b05aff1c27d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"B","sha256":"c34f39a233844c727914156102e817ce78969051b7021ebabb5e741f5455625d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Audit","sha256":"0f241cc0324871a1a900a7ac0edf889a8d12875b1072f44856cc979a4b7a77ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Dentists","sha256":"226099aac21e8d4a671a68b37d204339703fb696b6cc5aa30311fb55d6ab2147","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Disturbed","sha256":"8834f63f09734b9f284437f26cba4909ce9ae1aceafa27e2bcd7531c1a7479df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Flavor","sha256":"4efff79e94f136f9bbaed62501810937785831b8c10ee9eb675ceae24cf3c4c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Justice","sha256":"ae9283c1a14b751639a75592295d85105954b761737ab77fc1e667a1498f2e9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Proceeds","sha256":"70fda66f3ea2607d6cff63d0a6a7258577690d2a9bc5105bb529889ce025d1c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Revenue","sha256":"9a0a3567f4c9b9ca46fbf41d65cdd5ce464b0efe42d6aaf7cff840addbe05d60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"ModuleAnalysisCache","sha256":"a4f25ba127d1e1607df4027f2e99bfef3d4e176f393179fd07c07cfecf71871c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"3130B1871A126520A8C47861EFE3ED4D","sha256":"1d9ee082745c4577a90f191c9f4e2aede0bdb6212254852bbbb56ebbd62ef81b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"Dr.com","sha256":"865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\nsxECAF.tmp","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"C:\\MIRC\\SCRIPT.INI","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%WINDIR%\\MovieArchives","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Commissioner","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Disturbed","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Audit","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Proceeds","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Flavor","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Revenue","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Artistic","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Zip","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Soundtrack","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Dentists","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Justice","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%WINDIR%\\PackageExpression","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\Audit.cmd","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\491505\\B","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%LOCALAPPDATA%\\CreativePixel Tech\\E","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.scr","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%LOCALAPPDATA%\\CreativePixel Tech\\ApolloPro.js","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\491505\\RegAsm.exe","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\1gadodqr.fxm.ps1","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%TEMP%\\fbfmkcjs.loj.psm1","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\7a9c0f279c464958aebbd585f20f1cf2","sources":[{"report_type":"sandbox","report_id":"6a8d823ea9131cfd3f0c3e7e"}]}]}},"report_ids":{"sandbox_job_ids":["6a8d823ea9131cfd3f0c3e7e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 6092579a9979… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6092579a9979…. Malware family: Trojan.Generic. Threat score 100/100. 7/24 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 6092579a9979… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6092579a9979…. Malware family: Trojan.Generic. Threat score 100/100. 7/24 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 6092579a9979… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6092579a9979…. Malware family: Trojan.Generic. Threat score 100/100. 7/24 AV engines flagged this file. 11 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L74","11",{}]]