26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T435,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 6dfbd3a99315… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6dfbd3a99315…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b"],"about":{"@type":"SoftwareApplication","name":"KanaBootstrapper.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8ef,Found reference to API "AsyncVoidMethodBuilder" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "RunAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "RenameGameWindow" (Indicator: "rename"; Source: "sample.bin"), Found reference to API ";SoneroBootstrapper.Installer+d__37" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "1SoneroBootstrapper.Installer+d__26" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "SetStateMachine" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "b__3" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__2" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "d__21" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), Found reference to API "InstallAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "OnHandleCreated" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "EnsureSuccessStatusCode" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "System.Runtime.Serialization" (Indicator: "time"; Source: "sample.bin"), Found reference to API "k__BackingField" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__21_0" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "b__21_1" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "SecurityProtocolType" (Indicator: "security"; Source: "sample.bin"), Found reference to API "0SoneroBootstrapper.Installer+d__20" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "AsyncTaskMethodBuilder`1" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "set_Status" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "_status" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "CreateSubKey" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "DownloadAsync" (Indicator: "sync"; Source: "sample.bin")28:T752,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "::WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp")29:Taad,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "__crtGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp")2a:T706,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "__crtFreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.AC064000.00000002.mdmp")2b:T67a,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp")2c:T600,"KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1437815249 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1437821492 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1438009113 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1438016302 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1438130929 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1438137938 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1439874883 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1439881716 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1440568218 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1440575143 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1441446223 [PID: 6632] "KanaBootstrapper.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-1441452909 [PID: 6632] "identity_helper.exe" queried SystemProcessInformation at 00000000-00003136-00000C15-1572186988 [PID: 3136] "identity_helper.exe" queried SystemProcessInformation at 00000000-00003136-00000C15-1572196221 [PID: 3136]2d:T590,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "__crtGetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp")2e:T167c,"KanaBootstrapper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000992fb7f0000a00cce9ecc020000a8ec1b97ea0000000600000000000000c1da00b9fb7f00000000000000000000000000000000000090ea1b97ea0000000000000000000000e0e91b97ea00000070d30eb9fb7f00000000000000000000f0d20eb9fb7f00000800000000000000f82184a0cc02000000000000000000008503fe7f0000000000000001ea00000000ea1b97ea0000000000000069002d0000017aa0cc02000069006e002d0063006f00720065002d000000000000000000802900b9fb7f0000010000002d003000000073002d006c0031002d0031002d009399feb8fb7f0000000066b6fb7f0000084604b9fb7f0000802bce9e (UID: 00000000-00006632) "KanaBootstrapper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000700ed99ecc020000101902b9fb7f0000000000000000000000005cb7fb7f00000000000000000000ee269ab6fb7f0000070000000000000090af1b97ea00000090af1b97ea000000400ea8b6fb7f000000005cb7fb7f00007b636ab6fb7f0000030000000000000000000000000000009200000000000000a004ccb7fb7f000080af1b97ea000000bb5f9ab6fb7f00000d000000fb7f0000a004ccb7fb7f000092000000000000000000000000000000a004ccb7fb7f00001c5b9ab6fb7f0000000000000000000092000000000000000d000000fb7f00000d00000000000000aa00000000000000d2456db7fb7f0000a03a72b7 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000a42800b9fb7f0000202fcf9ecc020000000000000000000000000000000000000965b6b8fb7f00000100000002000000f800658afb7f0000809acd9ecc02000004000000ea000000202fcf9ecc020000302eb6b8fb7f000000f5cd9ecc0200005441b6b8fb7f0000ed030000cc020000484a6e8afb7f000000000000fb7f0000f800658afb7f000000a2b6b8fb7f00000000658afb7f00000000000000000000ee5b00b9fb7f000001000000000000000000000000000000802dce9ecc02000048e11b97ea0000000500000000000000c1da00b9fb7f00000100000000000000f800658afb7f0000f8e51b97ea000000e9fe6c8afb7f000090e11b97 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000a003e99ecc02000074e21b97ea0000000d000000030000004db4ffb8fb7f00000000e99ecc020000a85e03b9fb7f000000000000000000009e3ddcb3fb7f00009803e99ecc020000b4e21b97ea000000602a14bacc020000502a14bacc0200000000000000000000343ddcb3fb7f0000602a14bacc020000602a14bacc020000602a14bacc020000000000000000000000000000000000003ba36cb6fb7f00000000000000000000a85e03b9fb7f000030e41b97ea000000e08dd99ecc02000000000000000000000000000000000000d000000000000000e08dd99ecc0200000000000000000000409d02b8fb7f000000000000 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006632) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003136) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003136)2f:T9b4,"KanaBootstrapper.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "ENABLEMULTICAST"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "QUERYADAPTERNAME"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEMULTICAST"; Value: "")30:T27cf,"KanaBootstrapper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\1129d7af3a2939c4d5bdf327cb883faa\System.Net.Http.ni.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006632) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\145.0.3800.58\msedge.dll (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003136) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003136)31:Tbe04,"KanaBootstrapper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OleCreatePictureIndirect (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CopyImage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsCount (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipImageGetFrameDimensionsList (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipSetPageUnit (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDrawRectangleI (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GdipCreateLineBrushFromRectI (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00006632) "KanaBootstrapper.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00006632) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00003136) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00003136)32:T418,Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp")33:T646,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "ResumeThread failed" (Indicator: "ResumeThread"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp")34:T92a,Process KanaBootstrapper.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6632:304:WilStaging_02" Process KanaBootstrapper.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6632:304:WilStaging_02" Process KanaBootstrapper.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6632:120:WilError_03" Process KanaBootstrapper.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process KanaBootstrapper.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6632:120:WilError_03" Process KanaBootstrapper.exe created mutex with name "Local\SM0:6632:120:WilError_03" Process KanaBootstrapper.exe created mutex with name "SM0:6632:304:WilStaging_02" Process KanaBootstrapper.exe created mutex with name "Local\SM0:6632:304:WilStaging_02" Process KanaBootstrapper.exe created mutex with name "SM0:6632:120:WilError_03" Process KanaBootstrapper.exe created mutex with name "Global\RasPbFile" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "SM0:3044:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:3044:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:3044:120:WilError_03" Process msedge.exe created mutex with name "Local\SM0:3044:120:WilError_03" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3044:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3044:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3044:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3044:120:WilError_03" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8488:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:8488:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:8488:304:WilStaging_02"35:Ta14,"KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "KanaBootstrapper.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]36:T4842,"SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003136.00000000.208337.33820000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00003136.00000000.208337.33820000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "Software\" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000000.199801.2EB10000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000000.199801.2EB10000.00000004.mdmp "E\Software\M" in Source: 00000000-00006632.00000000.199801.9ECD0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006632.00000000.199801.A0B30000.00000004.mdmp "R\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006632.00000000.199801.B9470000.00000004.mdmp "E\Software\M" in Source: 00000000-00006632.00000001.201721.9ECD0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006632.00000001.201721.A0B30000.00000004.mdmp "R\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006632.00000001.201721.B9470000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000002.203641.2EB10000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000002.203641.2EB10000.00000004.mdmp "E\Software\M" in Source: 00000000-00006632.00000002.203641.9ECD0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006632.00000002.203641.A0B30000.00000004.mdmp "R\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006632.00000002.203641.B9470000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007992.00000000.208012.33820000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00007992.00000000.208012.33820000.00000002.mdmp37:T1e0c,"KanaBootstrapper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb92090000 "KanaBootstrapper.exe" loaded module "ADVAPI32.DLL" at base 2cca07a0000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffbb6660000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffbb6660000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffbb6660000 "KanaBootstrapper.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb8eac0000 "KanaBootstrapper.exe" loaded module "SHLWAPI.DLL" at base 7ffbb8700000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffbb44f0000 "KanaBootstrapper.exe" loaded module "VERSION.DLL" at base 7ffbad6c0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb8df80000 "KanaBootstrapper.exe" loaded module "USER32.DLL" at base 7ffbb8ac0000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffbb6660000 "KanaBootstrapper.exe" loaded module "MSCOREE.DLL" at base 7ffba09b0000 "KanaBootstrapper.exe" loaded module "NTDLL" at base 7ffbb8fd0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffbb7070000 "KanaBootstrapper.exe" loaded module "PSAPI.DLL" at base 7ffbb8900000 "KanaBootstrapper.exe" loaded module "RPCRT4.DLL" at base 7ffbb8c80000 "KanaBootstrapper.exe" loaded module "KERNEL32.DLL" at base 7ffbb74f0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffb8c860000 "KanaBootstrapper.exe" loaded module "OLE32.DLL" at base 7ffbb7ee0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffbb4000000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffbb7070000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffbb6660000 "KanaBootstrapper.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb8c710000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffb8ba90000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\908B5C1DEBCFB784BC25157A8EBCDFBE\SYSTEM.DRAWING.NI.DLL" at base 7ffb8b650000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\061200DCB8937E1B9EB2641F2CE9D2EC\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffb889e0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffb87f60000 "KanaBootstrapper.exe" loaded module "UXTHEME.DLL" at base 7ffbb4000000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb8b510000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffb80eb0000 "KanaBootstrapper.exe" loaded module "NTDLL.DLL" at base 7ffbb8fd0000 "KanaBootstrapper.exe" loaded module "SHELL32.DLL" at base 7ffbb75c0000 "KanaBootstrapper.exe" loaded module "BCRYPT.DLL" at base 7ffbb6960000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffbb5630000 "KanaBootstrapper.exe" loaded module "IMM32.DLL" at base 7ffbb8f60000 "KanaBootstrapper.exe" loaded module "COMCTL32.DLL" at base 7ffb8a650000 "KanaBootstrapper.exe" loaded module "GDI32.DLL" at base 7ffbb7d30000 "KanaBootstrapper.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\1129D7AF3A2939C4D5BDF327CB883FAA\SYSTEM.NET.HTTP.NI.DLL" at base 7ffb8b9e0000 "KanaBootstrapper.exe" loaded module "IPHLPAPI.DLL" at base 7ffbb59f0000 "KanaBootstrapper.exe" loaded module "GDIPLUS.DLL" at base 7ffb92de0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.19041.6456_NONE_91A399B0CC88BC24\GDIPLUS.DLL" at base 7ffb92de0000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffbb6660000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ffbabd50000 "KanaBootstrapper.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffbb3da0000 "KanaBootstrapper.exe" loaded module "OLEAUT32.DLL" at base 7ffbb7e10000 "KanaBootstrapper.exe" loaded module "COMCTL32.DLL" at base 7ffba18f0000 "KanaBootstrapper.exe" loaded module "RASAPI32.DLL" at base 7ffba90a0000 "KanaBootstrapper.exe" loaded module "RASMAN.DLL" at base 7ffba9060000 "KanaBootstrapper.exe" loaded module "WS2_32.DLL" at base 7ffbb85e0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffbb5d10000 "KanaBootstrapper.exe" loaded module "WINHTTP.DLL" at base 7ffbaefa0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb9fd00000 "KanaBootstrapper.exe" loaded module "COMBASE.DLL" at base 7ffbb7070000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffbb7070000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffbaced0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffbad3c0000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 2ccb9570000 "KanaBootstrapper.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffbb8ac0000 "KanaBootstrapper.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffbb8ac0000 "KanaBootstrapper.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffbb7070000 "KanaBootstrapper.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffbb7ee0000 "identity_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb92090000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffbb6660000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffbb6660000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffbb6660000 "identity_helper.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffbb6f60000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffbb6660000 "identity_helper.exe" loaded module "KERNEL32" at base 7ffbb74f0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffbb6660000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffbb6660000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffbb6660000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ffbb7d60000 "identity_helper.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGE\APPLICATION\145.0.3800.58\MSEDGE.DLL" at base 7ffb63950000 "identity_helper.exe" loaded module "ADVAPI32.DLL" at base 7ffbb8520000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffbb4000000 "identity_helper.exe" loaded module "USER32.DLL" at base 7ffbb8ac0000 "identity_helper.exe" loaded module "SHELL32.DLL" at base 7ffbb75c0000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffbb7070000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffbb707000038:T497,"KanaBootstrapper.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],and al, byte ptr [eax],push edi,add byte ptr [edi], ch,add byte ptr [eax], al,add byte ptr [esi], al,add al, byte ptr [eax],add byte ptr [eax], al,movsb byte ptr es:[edi], byte ptr [esi],add byte ptr [eax], al,push edx,push ebx,inc ecx,xor al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"39:Tbd3,Process "msedge.exe" (UID: 00000000-00003044) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "msedge.exe" (UID: 00000000-00003044) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00008488) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_3044_EUIOVLKNPMLWVNRA", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="3044"" Process "msedge.exe" (UID: 00000000-00001624) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="12", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007228) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "identity_helper.exe" (UID: 00000000-00007992) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="djTw989pvZcHrPX", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="12", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="nWzslgv", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="djTw989pvZcHrPX", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\nWzslgv", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\nWzslgv", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753""3a:T4ac,"KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "KanaBootstrapper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "identity_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "identity_helper.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")3b:T1100,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006632-00000C2E-1098193167] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006632-00000C2B-1438672330] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006632-00000C2B-1438776666] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006632-00000C2B-1438851921] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00006632-00000C2B-1439115059] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006632-00000C2B-1439142404] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006632-00000C2B-1439196171] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00006632-00000C2B-1439279271] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00006632-00000C2B-1439335829] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll" [Source: 00000000-00006632-00000C2B-1439366019] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll" [Source: 00000000-00006632-00000C2B-1439411070] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00006632-00000C2B-1439475715] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00006632-00000C2B-1439632181] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll" [Source: 00000000-00006632-00000C2B-1439719450] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00006632-00000C2B-1439759462] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00006632-00000C2B-1439984938] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\1129d7af3a2939c4d5bdf327cb883faa\System.Net.Http.ni.dll" [Source: 00000000-00006632-00000C2B-1440357489] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006632-00000C2B-1440398437] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00006632-00000C2B-1440515813] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006632-00000C2B-1441000297] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00006632-00000C2B-1441205928] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00006632-00000C2B-1441324535] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00006632-00000C2B-1441391800] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006632-00000C2B-1441594383] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006632-00000C2B-1441703389]3c:T848,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00003044) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008488), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00001624), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008068), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007228), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007876), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00008828), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --disable ..." (UID: 00000000-00008692), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00008728), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004368), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008664), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00007992), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00003136), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00003764), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00006596)3d:T848,Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00003044) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008488), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00001624), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00008068), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007228), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007876), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00008828), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --disable ..." (UID: 00000000-00008692), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --disable-gpu-compositing - ..." (UID: 00000000-00008728), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00004368), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00008664), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00007992), Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00003136), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00003764), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00006596)3e:T49e,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority : Priority Increased" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "ScopedMayLoadLibraryAtBackgroundPriority" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "__vcrt_LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003136.00000000.208337.AC064000.00000002.mdmp")3f:T8fb,"KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KANABOOTSTRAPPER.EXE"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\LANGUAGEOVERLAY\OVERLAYPACKAGES\EN-US"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PROPERTYBAG"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "KanaBootstrapper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "")40:Tace,"KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: "AUTOPROXYAUTOLOGONIFCHALLENGED"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "WINHTTPLOWERCASEHOST"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "TZI"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2006"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "MUI_DISPLAY"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "MUI_STD"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME"; Key: "MUI_DLT"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "CATEGORY"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: "NAME"; Value: "")41:T4a9,"KanaBootstrapper.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "KanaBootstrapper.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll.aux" "KanaBootstrapper.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\061200dcb8937e1b9eb2641f2ce9d2ec\system.windows.forms.ni.dll.aux" "KanaBootstrapper.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\fe3c9cf707273488c6c658d52d624640\system.ni.dll.aux" "KanaBootstrapper.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\908b5c1debcfb784bc25157a8ebcdfbe\system.drawing.ni.dll.aux" "KanaBootstrapper.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\21ff4ba4607b18a9b179ab90fd3b0bc1\system.core.ni.dll.aux" "KanaBootstrapper.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\24206316825bb75ebfbdd31895df2f1f\system.configuration.ni.dll.aux" "KanaBootstrapper.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\76ff225c5a523f0be2364b0fc02bf7f9\system.xml.ni.dll.aux"42:T5c5,"KanaBootstrapper.exe" trying to access non-existent file "C:\FLTLIB.DLL" "KanaBootstrapper.exe" trying to access non-existent file "C:\MSVCP140.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "KanaBootstrapper.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll"43:T405,"KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.local" "KanaBootstrapper.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "KanaBootstrapper.exe" trying to access non-existent file "C:\KanaBootstrapper.exe.config" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\SoneroBootstrapper" "KanaBootstrapper.exe" trying to access non-existent file "C:\KanaBootstrapper.INI" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "KanaBootstrapper.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "KanaBootstrapper.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "KanaBootstrapper.exe" trying to access non-existent file "\Device\RasAcd"44:T399c,Found URL "https://www.office.comthumbnail" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2093703https://go.microsoft.com/fwlink/?linkid=2348603sites" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2118167" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatementyou're" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149872an" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165400to" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165278https://go.microsoft.com/fwlink/?linkid=2348701https://go.microsoft.com/fwlink/?linkid=2165325https://go.microsoft.com/fwlink/?linkid=2348900use" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2301855allow" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149000browsing" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2194724ai-powered" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/view-device-and-app-use-with-family-safety-activity-reporting-b7b8501e-e35c-2224-bed8-115d5da4fbafto" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccfto" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://microsoftedgetips.microsoft.com/en-us/internet" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2211966writing" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=521839microsoft" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2279846see" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2166676learn" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://easylist.to/easylist/easylist.txtthe" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://easylist.to/index.htmlallow" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2181135adds" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2161865alerts" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://aka.ms/techscam-detection-learn-moreblock" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=529732manage" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2105403this" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2121003when" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/servicesagreementmanage" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2101140change" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://aka.ms/accountsecuritylearn" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://aka.ms/synclearnmorelinkprofile" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2333202save" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2167671use" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://example.comsuper" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2257424keep" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140nhttps://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140mcopilot" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337628https://go.microsoft.com/fwlink/?linkid=2345959explore" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337721https://go.microsoft.com/fwlink/?linkid=2345869discover" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addonsno" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://aka.ms/edgeprintingtroubleshooting" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://aka.ms/printtroubleshootingneed" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2126235if" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://www.bing.com/new/termsofuseenhanceenhance" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://www.microsoft.com/edge/copilot-mode?form=mg0awropen" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/copilot/privacy-and-protections" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://aka.ms/whatisscarewarequick" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi," - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "http://force" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373the" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/allow" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2151738learn" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://example.com.your" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2114059" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2193240check" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatement" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2189718protected" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/privacystatementalways" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "http://microsoft.com/edge/surfintroducing" - Source: "00000000-00003136.00000000.208337.B71A0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006632.00000000.199801.9ECD0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalrootc:\kanabootstrapper.exe.configfile:///c:/kanabootstrapper.exec:/kanabootstrapper.exec:\kanabootstrapper.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.8versionv4.80123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\nwzslgv\appdata\roaming\microsoft\clr" - Source: "00000000-00006632.00000000.199801.A0B30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006632.00000000.199801.A0B30000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006632.00000000.199801.A0B30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006632.00000001.201721.9ECD0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalrootc:\kanabootstrapper.exe.configfile:///c:/kanabootstrapper.exec:/kanabootstrapper.exec:\kanabootstrapper.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.8versionv4.80123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\nwzslgv\appdata\roaming\microsoft\clr" - Source: "00000000-00006632.00000001.201721.A0B30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006632.00000001.201721.A0B30000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006632.00000001.201721.A0B30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006632.00000002.203641.9ECD0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json10/23" - Source: "00000000-00006632.00000002.203641.A0AB0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,010/23" - Source: "00000000-00006632.00000002.203641.A0AB0000.00000002.mdmp")45:T957,"KanaBootstrapper.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter 6078762b90671c2ff9ba39318e2176d8 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\SoneroBootstrapper\* (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter 061200dcb8937e1b9eb2641f2ce9d2ec (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter 808887ebadf1a37835b907c866cede3c (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindNextFileW" with parameter fe3c9cf707273488c6c658d52d624640 (UID: 00000000-00006632) "KanaBootstrapper.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00006632)46:Ta98,Found reference to API "GetFileAttributesExFromAppW" (Indicator: "GetFileAttributes"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "__crtGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003136.00000000.208337.8B961000.00000002.mdmp")47:T4d5,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp")48:Tc8f,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003136.00000000.208337.764F1000.00000002.mdmp")49:T907,"KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "KanaBootstrapper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "")4a:T8de,"KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "KanaBootstrapper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KANABOOTSTRAPPER_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")4b:T498,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADOElEQVR4XsWX+U8UMRTH+U/9QQM7A2ii8TbszCxoQESi/qDRREBYFhBBJR6IR5BEghKNgkZWwpEgR1xDOITdha19o21f30z3IEQ/SZNJ+47vTF+PKSvbRzy7k3lWO6P9/wSvMsF8AdD4s2t17F2IY/Uw92+w2iPtKjBv0E/t8Tht1DaUmMUVl8cDzqaGfXF/X8sbtr76K2DvVXblF+LZenInEmfnD3eztuYX7OPYLNvaTDM3omyUn/JJXB9mmE/cz7WUj2t1sgvVhi8ijFqahrQgGCpATBG01svPqbmk5+aI9nJ+fUSIEDH44M4o9ZdgAY7dIZ+v1jykpgFyuRxrOtWnCYnhaRGdI08nqa9ECVBC6o/epWZ5wQJqDw0EBUyOz1MfCZ5PP0BVgpoYSW9nNf9YpWEK5r+tUF8JFVAsM1PLmp/HV5yWHAtILa9RfwlUcanJcQHGuL9jWo7CaGNti8aQeDxAXXUX7TYCy1gm5+2s3RqeHBCG21sZGkfSfKafdoUC04i/FhQtzadRc6BXGu9kd2m8krhR9xgl7vTXPM0XwLHVXp/bzdGYRbE4/5MUaZydO9hSODng2eoUy5WYH+wvndQ3mKhdxFtj8A5XCoO97/XPzZsb2cMR7FWoACYy6Szt8oENBlYGFgEVT3PkBW+tJob6PrBZvqGYmP68SE4+/mwVqH4BrgETc8kVf3z8dZIOadxvGw1MS0EhsMEIYzi1woD9Qdg86R6nwwGaTvcTIXkKs6a8VRru7oQLAHDA9isv6XCA1dQGEfHnokPzl7U1DEiDTHqHxpHQw+hadICahPJuOElOQiha8kXE4Ob6NvWXUAHQ6o8Vfx+AW5Puj0SIzh9L5tMQLh9g41TE+c0YvVEJ94LGE/eUAFyconPm6xL1kdxufCadfR9UvHD4FOLicXXmePSfQQyMvZqifpLhRxOaAMCtwiLiLJsJr6FatFmBWJzbRwzeahhkE2/n2Pe5FFvj9/sMCrgwmwoIAGDnw8Hhv0CQnFgIHFLYV6IMzA2f8VFbv9l4tr4dT39Z1N5aNOyj4UTw71fCv/1QZ9yckHOe2mjNdBXbb6IRtEL4zdf5X3/KpfAbiI0x6usexecAAAAASUVORK5CYII=4c:T498,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADOElEQVR4XsWX+U8UMRTH+U/9QQM7A2ii8TbszCxoQESi/qDRREBYFhBBJR6IR5BEghKNgkZWwpEgR1xDOITdha19o21f30z3IEQ/SZNJ+47vTF+PKSvbRzy7k3lWO6P9/wSvMsF8AdD4s2t17F2IY/Uw92+w2iPtKjBv0E/t8Tht1DaUmMUVl8cDzqaGfXF/X8sbtr76K2DvVXblF+LZenInEmfnD3eztuYX7OPYLNvaTDM3omyUn/JJXB9mmE/cz7WUj2t1sgvVhi8ijFqahrQgGCpATBG01svPqbmk5+aI9nJ+fUSIEDH44M4o9ZdgAY7dIZ+v1jykpgFyuRxrOtWnCYnhaRGdI08nqa9ECVBC6o/epWZ5wQJqDw0EBUyOz1MfCZ5PP0BVgpoYSW9nNf9YpWEK5r+tUF8JFVAsM1PLmp/HV5yWHAtILa9RfwlUcanJcQHGuL9jWo7CaGNti8aQeDxAXXUX7TYCy1gm5+2s3RqeHBCG21sZGkfSfKafdoUC04i/FhQtzadRc6BXGu9kd2m8krhR9xgl7vTXPM0XwLHVXp/bzdGYRbE4/5MUaZydO9hSODng2eoUy5WYH+wvndQ3mKhdxFtj8A5XCoO97/XPzZsb2cMR7FWoACYy6Szt8oENBlYGFgEVT3PkBW+tJob6PrBZvqGYmP68SE4+/mwVqH4BrgETc8kVf3z8dZIOadxvGw1MS0EhsMEIYzi1woD9Qdg86R6nwwGaTvcTIXkKs6a8VRru7oQLAHDA9isv6XCA1dQGEfHnokPzl7U1DEiDTHqHxpHQw+hadICahPJuOElOQiha8kXE4Ob6NvWXUAHQ6o8Vfx+AW5Puj0SIzh9L5tMQLh9g41TE+c0YvVEJ94LGE/eUAFyconPm6xL1kdxufCadfR9UvHD4FOLicXXmePSfQQyMvZqifpLhRxOaAMCtwiLiLJsJr6FatFmBWJzbRwzeahhkE2/n2Pe5FFvj9/sMCrgwmwoIAGDnw8Hhv0CQnFgIHFLYV6IMzA2f8VFbv9l4tr4dT39Z1N5aNOyj4UTw71fCv/1QZ9yckHOe2mjNdBXbb6IRtEL4zdf5X3/KpfAbiI0x6usexecAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792785543016,"unified_at":"2026-10-23T19:59:03.016Z","metadata":{"hashes":{"sha256":"6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","sha1":"7687852aec261f501eee1b06e09479e5aa287d1b","md5":"3c4edbb74dda1beed539d15157a27e10","sha512":"e407398919acc4006e29593a4484a694418e46b60fa7ef6f7e96b8b4f1f064ff37dfc7a6a6ad088ccb7bd69e69f9eafe948fdbd414abb323edac1f987656e4bf","ssdeep":"1536:QcEPlUQt6vx8JeqhpYUrymMcM+JypnlTgFBMka+V5pa+V7:utwO8m9M+40vMqRV","ssdeep_chunks":["1536:QcEPlUQ","1536:cEPlUQt","1536:EPlUQt6","1536:PlUQt6v","1536:lUQt6vx","1536:UQt6vx8","1536:Qt6vx8J","1536:t6vx8Je","1536:6vx8Jeq","1536:vx8Jeqh","1536:x8Jeqhp","1536:8JeqhpY","1536:JeqhpYU","1536:eqhpYUr","1536:qhpYUry","1536:hpYUrym","1536:pYUrymM","1536:YUrymMc","1536:UrymMcM","1536:rymMcM+","1536:ymMcM+J","1536:mMcM+Jy","1536:McM+Jyp","1536:cM+Jypn","1536:M+Jypnl","1536:+JypnlT","1536:JypnlTg","1536:ypnlTgF","1536:pnlTgFB","1536:nlTgFBM","1536:lTgFBMk","1536:TgFBMka","1536:gFBMka+","1536:FBMka+V","1536:BMka+V5","1536:Mka+V5p","1536:ka+V5pa","1536:a+V5pa+","1536:+V5pa+V","1536:V5pa+V7","3072:QcEPlUQ","3072:cEPlUQt","3072:EPlUQt6","3072:PlUQt6v","3072:lUQt6vx","3072:UQt6vx8","3072:Qt6vx8J","3072:t6vx8Je","3072:6vx8Jeq","3072:vx8Jeqh","3072:x8Jeqhp","3072:8JeqhpY","3072:JeqhpYU","3072:eqhpYUr","3072:qhpYUry","3072:hpYUrym","3072:pYUrymM","3072:YUrymMc","3072:UrymMcM","3072:rymMcM+","3072:ymMcM+J","3072:mMcM+Jy","3072:McM+Jyp","3072:cM+Jypn","3072:M+Jypnl","3072:+JypnlT","3072:JypnlTg","3072:ypnlTgF","3072:pnlTgFB","3072:nlTgFBM","3072:lTgFBMk","3072:TgFBMka","3072:gFBMka+","3072:FBMka+V","3072:BMka+V5","3072:Mka+V5p","3072:ka+V5pa","3072:a+V5pa+","3072:+V5pa+V","3072:V5pa+V7","1536:utwO8m9","1536:twO8m9M","1536:wO8m9M+","1536:O8m9M+4","1536:8m9M+40","1536:m9M+40v","1536:9M+40vM","1536:M+40vMq","1536:+40vMqR","1536:40vMqRV"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"KanaBootstrapper.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":62976,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792785146000,"last_seen":1792785146000,"last_multi_scan":1792785146000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":70},"sandbox_signatures":{"informative_count":182,"suspicious_count":8,"malicious_count":1,"total":191},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"SetWindowText\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SendMessage\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ReleaseCapture\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\SoneroBootstrapper-main\\obj\\Release\\SoneroBootstrapper.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Classes\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://kanade.cfd/client/manifest-2020.json\", Pattern match: \"https://kanade.cfd/client/manifest-v2.json\", Pattern match: \"https://kanade.cfd\", Heuristic match: \"roblox.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://kanade.cfd\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ZipFile\" (Indicator: \"zipfile\"; Source: \"sample.bin\"), Found string \"PatchRsa2Key\" (Indicator: \"rsa2\"; Source: \"sample.bin\"), Found string \"RSA2\" (Indicator: \"rsa2\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"ZipFileExtensions\" (Indicator: \"zipfile\"; Source: \"sample.bin\"), Found string \"Rsa2Header\" (Indicator: \"rsa2\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopShortcut\" (Indicator: \"CreateDesktop\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-541","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"DecompressionStream\" (Source: \"00000000-00003136.00000000.208337.B6DD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread failed\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.ZipFile\" in \"KanaBootstrapper.exe\"\n Observed function \"System.IO.Compression.ZipArchive\" in \"KanaBootstrapper.exe\"\n Observed function \"System.IO.Compression.ZipArchiveEntry\" in \"KanaBootstrapper.exe\"\n Observed function \"System.IO.Compression.ZipFileExtensions\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - PE_NAME=\\\\.\\pi; Source: \"00000000-00003136.00000000.208337.B4100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at AAA30000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"KanaBootstrapper.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"KanaBootstrapper.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"KanaBootstrapper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000006\")\n \"KanaBootstrapper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000007\")\n \"KanaBootstrapper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000007\")\n \"KanaBootstrapper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\")\n \"KanaBootstrapper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\")\n \"KanaBootstrapper.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\{7746D80F-97E0-4E26-9543-26B41FC22F79}\\{FB9F5B62-B48B-45F5-8586-E514958C92E2}\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"fromCharCodeU\" (Indicator: \"fromcharcode\"; Source: \"00000000-00003136.00000000.208337.B6DD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"KanaBootstrapper.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006632-00000C2C-1439820922\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006632-00000C2C-1439820922\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00006632-00000C2C-1441068821\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006632-00000C2C-1440265830\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006632-00000C2C-1438850278\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006632-00000C2C-1438850963\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006632-00000C2C-1442103385\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"KanaBootstrapper.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"KanaBootstrapper.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"KanaBootstrapper.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"KanaBootstrapper.exe\" called \"GetWindowTextW\" with parameter \"Kana\" - (UID: 00000000-00006632)\n \"KanaBootstrapper.exe\" called \"GetWindowTextW\" (UID: 00000000-00006632)\n \"KanaBootstrapper.exe\" called \"GetWindowTextW\" with parameter \"Starting Kana ...\" - (UID: 00000000-00006632)\n \"KanaBootstrapper.exe\" called \"GetWindowTextW\" with parameter \"1527\" - (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"KanaBootstrapper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"KanaBootstrapper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"KanaBootstrapper.exe\" queried token user identity (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"KanaBootstrapper.exe\" queries volume information of \"C:\\KanaBootstrapper.exe\" at 00000000-00006632-00000C17-1439141560","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"KanaBootstrapper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"KanaBootstrapper.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"KanaBootstrapper.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Kana (UID: 00000000-00006632)\n \"KanaBootstrapper.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Kana\\Downloads (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cdn.kanade.cfd\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.63.172:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")\n Found reference to API \"?_XGetLastError@std@@YAXXZ\" (Indicator: \"GetLastError\"; Source: \"00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$34","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"KanaBootstrapper.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"KanaBootstrapper.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"r@uma.negativesamples.reason\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"SetWindowText\" in \"KanaBootstrapper.exe\"\n Observed unmanaged function \"ReleaseCapture\" in \"KanaBootstrapper.exe\"\n Observed unmanaged function \"SendMessage\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - EDGE_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\crashpad_3044_EUIOVLKNPMLWVNRA\n Found string - \\\\.\\pipe\\LOCAL\\mojo.\n Found string - \\\\.\\pipe\\mojo.\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00003044)\n Launches browser \"msedge.exe\" (UID: 00000000-00008488)\n Launches browser \"msedge.exe\" (UID: 00000000-00001624)\n Launches browser \"msedge.exe\" (UID: 00000000-00008068)\n Launches browser \"msedge.exe\" (UID: 00000000-00007228)\n Launches browser \"msedge.exe\" (UID: 00000000-00007876)\n Launches browser \"msedge.exe\" (UID: 00000000-00008828)\n Launches browser \"msedge.exe\" (UID: 00000000-00008692)\n Launches browser \"msedge.exe\" (UID: 00000000-00008728)\n Launches browser \"msedge.exe\" (UID: 00000000-00004368)\n Launches browser \"msedge.exe\" (UID: 00000000-00008664)\n Launches browser \"msedge.exe\" (UID: 00000000-00003764)\n Launches browser \"msedge.exe\" (UID: 00000000-00006596)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"KanaBootstrapper.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 8C860000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"KanaBootstrapper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at B6960000\n \"KanaBootstrapper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B6F60000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at B6960000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B6F60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"KanaBootstrapper.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 8DF80000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"KanaBootstrapper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B8C80000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B8C80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a384b6fb7f0000@ntdll.dll\"\n \"220023000000000038a384b6fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"KanaBootstrapper.exe\" was detected as \".NET\" and name: \"Library\"\n \"KanaBootstrapper.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"KanaBootstrapper.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"KanaBootstrapper.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"KanaBootstrapper.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"2.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.5.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa\"\n \"cdn.kanade.cfd\"\n \"e.b.6.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.6.0.2.0.0.2.0.1.3.0.6.2.ip6.arpa\"\n \"e.f.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.0.1.0.0.0.3.0.1.3.0.6.2.ip6.arpa\"\n \"edge-consumer-static.azureedge.net\"\n \"f.4.3.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.7.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US\" (SHA1: 9C:FF:31:B5:1D:22:B9:BF:D3:80:8A:8C:35:B4:BB:DF:36:13:71:F0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US\" (SHA1: 27:E6:66:32:99:D3:40:DF:E5:45:71:CE:CC:EC:01:BE:74:49:5D:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"KanaBootstrapper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"identity_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"KanaBootstrapper.exe\" queries basic process information of the \"C:\\KanaBootstrapper.exe\" (UID: 6632)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"KanaBootstrapper.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"KanaBootstrapper.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\KanaBootstrapper.exe\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"KanaBootstrapper.exe\" trying to touch file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006632-00000C2C-1441377588\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006632-00000C2C-1441377384\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006632-00000C2C-1441570710\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006632-00000C2C-1441570790\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00006632-00000C2C-1442202584\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00006632-00000C2C-1442205140\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"KanaBootstrapper.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"KanaBootstrapper.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetNamedPipeClientProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetNamedPipeServerProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"KanaBootstrapper.exe\"\n Observed namespace \"System.Net.Http\" in \"KanaBootstrapper.exe\"\n Observed namespace \"System.Net.Http.Headers\" in \"KanaBootstrapper.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006632-00000C2C-1441377384\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 104.21.63.172 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$44","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"edge-consumer-static.azureedge.net\" (10 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")\n Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegGetValueW\" in \"00000000-00003136.00000000.208337.33820000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found registry query API: \"NtQueryValueKey\" in \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"::GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"NtQueryObject-type_info_length\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"KanaBootstrapper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"KanaBootstrapper.exe\" called \"GetComputerNameW\" (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"KanaBootstrapper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExFromAppW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"FindFirstFileEx\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"__crtGetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password_manager.mojom.CSVPasswordParser\" (Indicator: \"password\"; Source: \"00000000-00003136.00000000.208337.00004000.00000004.mdmp\")\n Found string \"passwords\" (Indicator: \"password\"; Source: \"00000000-00003136.00000000.208337.000BC000.00000004.mdmp, 00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found string \"password_manager\" (Indicator: \"password\"; Source: \"00000000-00003136.00000000.208337.000BC000.00000004.mdmp, 00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found string \"passwords/manual_filling_controller/0x?\" (Indicator: \"password\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteKey\" in \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteValueKey\" in \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"KanaBootstrapper.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006632)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00003136.00000000.208337.00054000.00000004.mdmp, 00000000-00003136.00000000.208337.B4100000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003136.00000000.208337.00054000.00000004.mdmp, 00000000-00003136.00000000.208337.B4100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWithDispositionFlags\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"DoDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"RemoveDirectory\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006632-00000C2C-1442293003\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003136.00000000.208337.000BC000.00000004.mdmp\n 00000000-00003136.00000000.208337.33820000.00000002.mdmp\n 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003136.00000000.208337.764F1000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp, 00000000-00003136.00000000.208337.8B961000.00000002.mdmp, 00000000-00003136.00000000.208337.A3B45000.00000002.mdmp, 00000000-00003136.00000000.208337.AC064000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003136.00000000.208337.33820000.00000002.mdmp, 00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"KanaBootstrapper.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"KanaBootstrapper.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"\n \"identity_helper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003136.00000000.208337.764F1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"ReleaseCapture\" (Source: KanaBootstrapper.exe, API is part of module: USER32.DLL)\n Found string \"Sleep\" (Source: KanaBootstrapper.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetCurrentProcess\" (Source: KanaBootstrapper.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"KanaBootstrapper.exe\" has section name .rsrc with entropy \"7.171496809031719\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"KanaBootstrapper.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"c0bed79ecc020000\"\n \"szProvider\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"KanaBootstrapper.exe\" has resource with unusual entropy \"RT_ICON:7.925995891576783\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.63.172 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to create/switch the desktop","description":"SoneroBootstrapper.Installer::CreateDesktopShortcut(System.String) at 3c4edbb74dda1beed539d15157a27e10-6000091-InstallerInstall2020Asyncd__18~MoveNext\n SoneroBootstrapper.Installer::CreateDesktopShortcut(System.String) at 3c4edbb74dda1beed539d15157a27e10-6000093-InstallerInstallAsyncd__20~MoveNext","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"KanaBootstrapper.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3101091e\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"KanaBootstrapper.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"6010831\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"KanaBootstrapper.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2e010c22\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"KanaBootstrapper.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1010bb9\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"KanaBootstrapper.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2010bd2\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"KanaBootstrapper.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"KanaBootstrapper.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"KanaBootstrapper.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"KanaBootstrapper.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"KanaBootstrapper.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"KanaBootstrapper.exe\" claims program is from Sat Jul 12 05:44:35 2053","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}],"intel_graph":{"map":{"Domain:2.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.5.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa":{"type":"Domain","value":"2.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.5.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa"},"Domain:cdn.kanade.cfd":{"type":"Domain","value":"cdn.kanade.cfd"},"Domain:e.b.6.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.6.0.2.0.0.2.0.1.3.0.6.2.ip6.arpa":{"type":"Domain","value":"e.b.6.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.6.0.2.0.0.2.0.1.3.0.6.2.ip6.arpa"},"Domain:e.f.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.0.1.0.0.0.3.0.1.3.0.6.2.ip6.arpa":{"type":"Domain","value":"e.f.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.0.1.0.0.0.3.0.1.3.0.6.2.ip6.arpa"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:f.4.3.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.7.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa":{"type":"Domain","value":"f.4.3.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.7.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa"},"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b":{"type":"File","value":"6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b"},"Ip:104.21.63.172":{"type":"Ip","value":"104.21.63.172"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Url:/2020L.zip":{"type":"Url","value":"/2020L.zip"}},"chains":[{"id":"sandbox_network","root":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","edges":[{"edge_kind":"contacted_ip","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Ip:104.21.63.172"},{"edge_kind":"contacted_domain","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Domain:2.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.5.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa"},{"edge_kind":"contacted_domain","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Domain:cdn.kanade.cfd"},{"edge_kind":"resolves_to","from_key":"Domain:cdn.kanade.cfd","to_key":"Ip:104.21.63.172"},{"edge_kind":"contacted_domain","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Domain:e.b.6.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.6.0.2.0.0.2.0.1.3.0.6.2.ip6.arpa"},{"edge_kind":"contacted_domain","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Domain:e.f.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.0.1.0.0.0.3.0.1.3.0.6.2.ip6.arpa"},{"edge_kind":"contacted_domain","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Domain:f.4.3.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.7.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa"},{"edge_kind":"contacted_url","from_key":"File:6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","to_key":"Url:/2020L.zip"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":16,"spawned_processes_count":16,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":40,"imported_dlls_count":192,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":6,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["suspicious"],"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"6adbbaf9e4660b9dea013226","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"KanaBootstrapper.exe","analysis_start_time":"2026-10-23T19:52:26+00:00","indicators_count":{"informative":181,"suspicious":21,"malicious":0},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.63.172","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}],"dns_resolutions":[{"domain":"2.0.5.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.5.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"domain":"cdn.kanade.cfd","address":"104.21.63.172","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"domain":"e.b.6.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.6.0.2.0.0.2.0.1.3.0.6.2.ip6.arpa","ttl":7,"country":"-","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"domain":"e.f.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.1.0.0.0.1.0.0.0.3.0.1.3.0.6.2.ip6.arpa","ttl":141,"country":"-","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":1592,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"domain":"f.4.3.0.0.0.0.0.0.0.0.0.0.0.0.0.e.0.0.0.7.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa","ttl":107,"country":"-","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}],"http_requests":[{"host":"cdn.kanade.cfd","host_ip":"104.21.63.172:80","url":"/2020L.zip","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /2020L.zip HTTP/1.1\nUser-Agent: KanaBootstrapper/1.0\nHost: cdn.kanade.cfd\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}],"processes":[{"pid":6632,"ppid":0,"name":"KanaBootstrapper.exe","command_line":"","sha256":"6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b","normalized_path":"C:\\KanaBootstrapper.exe","uid":"00000000-00006632","icon":"$4b"},{"pid":3044,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00003044","icon":"$4c"},{"pid":8488,"ppid":3044,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x354,0x7ffb765e0f18,0x7ffb765e0f24,0x7ffb765e0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00008488"},{"pid":1624,"ppid":3044,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1924,i,9390980328055432215,3735292283705088404,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2868 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00001624"},{"pid":8068,"ppid":3044,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1736,i,2397462033794874694,15351056431513744339,262144 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2400 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00008068"},{"pid":7228,"ppid":3044,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2136,i,13021107812477997003,14427050215492037685,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2976 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00007228"},{"pid":7876,"ppid":3044,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793056295842721 --launch-time-ticks=3235583652 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3404,i,18025904715933742182,3204755777893725284,2097152 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3660 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00007876"},{"pid":8828,"ppid":3044,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793056295842721 --launch-time-ticks=3235656562 --skip-read-main-dll --metrics-shmem-handle=3424,i,10168747966117128361,2386084132116940450,2097152 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3796 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00008828"},{"pid":8692,"ppid":3044,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1793056295842721 --launch-time-ticks=3238260704 --skip-read-main-dll --metrics-shmem-handle=4780,i,13871510930355183720,186540167388173184,2097152 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5508 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00008692"},{"pid":8728,"ppid":3044,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1793056295842721 --launch-time-ticks=3238246386 --skip-read-main-dll --metrics-shmem-handle=3996,i,4148916210837646271,3353408029739592934,2097152 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5108 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00008728"},{"pid":4368,"ppid":3044,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4884,i,1477010448694065670,15291845983875619610,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4840 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00004368"},{"pid":8664,"ppid":3044,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4364,i,13628289673093932129,3811980264867490889,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5824 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00008664"},{"pid":7992,"ppid":3044,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6444,i,8517988055280610909,6613525767618296041,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6400 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00003044","uid":"00000000-00007992"},{"pid":3136,"ppid":3044,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --skip-read-main-dll --metrics-shmem-handle=6444,i,8517988055280610909,6613525767618296041,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6400 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00003044","uid":"00000000-00003136"},{"pid":3764,"ppid":3044,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6600,i,16483825541264714937,830382559079397649,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6592 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00003764"},{"pid":6596,"ppid":3044,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6792,i,13492259692904588706,17669417034900497727,524288 --field-trial-handle=2412,i,16157897334024225178,441863275315114415,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6584 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003044","uid":"00000000-00006596"}],"all_imported_dlls":["comctl32.dll","IPHLPAPI.DLL","CoreUIComponents.dll","gpapi.dll","winsta.dll","usermgrcli.dll","d3d11.dll","gdi32full.dll","bcrypt.dll","version.dll","uxtheme.dll","wldp.dll","rasapi32.dll","Windows.Storage.Search.dll","FirewallAPI.dll","cryptsp.dll","System.Configuration.ni.dll","shell32.dll","dhcpcsvc.dll","edputil.dll","Windows.Networking.Connectivity.dll","rmclient.dll","ntdll.dll","ucrtbase.dll","imm32.dll","sechost.dll","dxgi.dll","vaultcli.dll","netprofm.dll","ncrypt.dll","mscoree.dll","kernel32.dll","KernelBase.dll","rpcrt4.dll","rsaenh.dll","rtutils.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","coloradapterclient.dll","umpdc.dll","sppc.dll","DataExchange.dll","Windows.System.Profile.RetailInfo.dll","oneds.dll","atlthunk.dll","OneCoreCommonProxyStub.dll","MicrosoftAccountWAMExtension.dll","System.Drawing.ni.dll","secur32.dll","aadWamExtension.dll","xmllite.dll","netapi32.dll","apphelp.dll","win32u.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","userenv.dll","mscms.dll","dusmapi.dll","ncryptprov.dll","ws2_32.dll","dnsapi.dll","FWPUCLNT.DLL","cfgmgr32.dll","iertutil.dll","sxs.dll","fwbase.dll","PCPKsp.dll","vcruntime140_1.dll","psapi.dll","IconCodecService.dll","setupapi.dll","webauthn.dll","SystemSettings.DataModel.dll","tbs.dll","vk_swiftshader.dll","shlwapi.dll","WindowManagementAPI.dll","slc.dll","domain_actions.dll","msvcp110_win.dll","ole32.dll","nsi.dll","wtsapi32.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","StructuredQuery.dll","vcruntime140_clr0400.dll","System.Windows.Forms.ni.dll","Windows.StateRepositoryPS.dll","mf.dll","System.ni.dll","rasman.dll","netutils.dll","AssignedAccessRuntime.dll","policymanager.dll","devobj.dll","msasn1.dll","kernel.appcore.dll","cryptbase.dll","OnDemandConnRouteHelper.dll","winmm.dll","powrprof.dll","dpapi.dll","WinTypes.dll","twinapi.dll","Windows.Security.Authentication.Web.Core.dll","srvcli.dll","ResourcePolicyClient.dll","SHCore.dll","System.Net.Http.ni.dll","Windows.StateRepositoryCore.dll","oneauth.dll","directmanipulation.dll","TenantRestrictionsPlugin.dll","vcruntime140.dll","profapi.dll","dhcpcsvc6.dll","WindowsCodecs.dll","KBDUS.DLL","OneCoreUAPCommonProxyStub.dll","ntasn1.dll","DXCore.dll","rasadhlp.dll","mdmregistration.dll","crypt32.dll","dcomp.dll","dwmapi.dll","microsoft_shell_integration.dll","d3dcompiler_47.dll","VxSSL64.dll","ucrtbase_clr0400.dll","windows.storage.dll","winhttp.dll","msedge.dll","combase.dll","advapi32.dll","mswsock.dll","dsreg.dll","telclient.dll","capauthz.dll","TextInputFramework.dll","twinapi.appcore.dll","sspicli.dll","well_known_domains.dll","Windows.ApplicationModel.dll","d3d10warp.dll","System.Core.ni.dll","msctf.dll","msedge_elf.dll","linkinfo.dll","libGLESv2.dll","user32.dll","bcryptprimitives.dll","DWrite.dll","dbghelp.dll","wlanapi.dll","oleaut32.dll","mscorlib.ni.dll","clrjit.dll","CoreMessaging.dll","ntmarta.dll","omadmapi.dll","Windows.UI.dll","imagehlp.dll","msvcp140.dll","wpnapps.dll","System.Xml.ni.dll","clbcatq.dll","nlaapi.dll","Windows.Web.dll","npmproxy.dll","AppXDeploymentClient.dll","fltLib.dll","gdi32.dll","clr.dll","oleacc.dll","ffmpeg.dll","mfplat.dll","msvcp_win.dll","winnsi.dll","dmcmnutils.dll","GdiPlus.dll","InputHost.dll","Windows.UI.Immersive.dll","onnxruntime.dll","propsys.dll","mscoreei.dll","TextShaping.dll","RTWorkQ.dll","msvcrt.dll","wkscli.dll","wintrust.dll","ShellCommonCommonProxyStub.dll","libEGL.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\crashpad_3044_EUIOVLKNPMLWVNRA","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.8596.1768144050608532396","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.8596.13276570311930698354","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.8596.9867914128013153095","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.7660.7336506189685951856","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.7660.11674835877350395593","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.8596.16768567059565294486","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.7660.16431330073026802454","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.7660.9447647837075313778","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.7660.10013350745134112554","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.7660.7327209292750605582","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.7660.16981675502383692254","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.3044.2112.1643643532221485891","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"path":"pipe\\LOCAL\\mojo.8728.2932.16380438450770869541","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6632:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6632:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"Local\\SM0:6632:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:6632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"Local\\SM0:6632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:6632:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"Local\\SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:3044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"Local\\SM0:3044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"Local\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8488:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"Local\\SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:7228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:7876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:8728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4368:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:4368:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:8664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]},{"name":"SM0:3136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adbbaf9e4660b9dea013226"}]}]}},"report_ids":{"sandbox_job_ids":["6adbbaf9e4660b9dea013226"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 6dfbd3a99315… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6dfbd3a99315…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 6dfbd3a99315… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6dfbd3a99315…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6dfbd3a9931571dc02da0e736d36260657a8c1f928f4efa47fef930ab9cad55b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 6dfbd3a99315… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6dfbd3a99315…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]