26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Loki Sample 7a1bb4fe0f62… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7a1bb4fe0f62…. Malware family: Trojan.Ransom.Loki. Threat score 100/100. 19/28 AV engines flagged this file. 17 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f","keywords":["Malicious","Trojan.Ransom.Loki","malware analysis","sandbox report","threat intelligence","7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f"],"about":{"@type":"SoftwareApplication","name":"sample.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Loki","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":17,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T805,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")28:T755,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")29:T504,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp")2a:T6a3,Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "AMSI") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "AMSI") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp")2b:Tbd6,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1460409739 [PID: 5528] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1460416990 [PID: 5528] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1460675659 [PID: 5528] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1460683108 [PID: 5528] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1462785772 [PID: 5528] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1462793581 [PID: 5528] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1463137311 [PID: 5528] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-1463144633 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1471649188 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1471656870 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1474243356 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1474251199 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1475907124 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1475915305 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1476333895 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1476392870 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1476729781 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1476737475 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1478536546 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1478996753 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1479097654 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1480994330 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1481007529 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1481305042 [PID: 6328] "powershell.exe" queried SystemProcessInformation at 00000000-00006328-00000C15-1481312548 [PID: 6328]2c:Td1c,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-70-00189177 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-86-00193EDB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-116-00194100 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-116-00194100 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-137-001937F7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-137-001937F7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-139-00193755 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-139-00193755 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-143-001932ED Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-143-001932ED Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-149-0019322A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-149-0019322A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-151-001931C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-151-001931C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-167-00192969 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-168-0019246F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-183-001920F4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-184-00192003 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-185-001919AB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-186-00191F5C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-186-00191F5C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-200-0018C6BB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-210-0018BAFF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-210-0018BAFF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-214-0018BD94 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-261-0018AC06 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-356-0018B56B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-358-0018D09A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-362-0018E56B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-374-0018B496 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-389-0018E7FD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-389-0018E7FD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-394-0018D3DE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006328-7616-410-0018CFEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006328-7616-410-0018CFEF2d:Tc0c,Found string "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----END RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----END EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----END DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")2e:T6b7,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to use PEM certificate for encryption and decryption Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Able to use RSA keys for encryption and decryption Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption2f:T968,Found XOR loop in file "sample.bin" at offset 403413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 482688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 539990; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 544616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 566057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 751661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 798188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 821451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 824215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 322793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 368709; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 426955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 431991; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 458725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 791574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 821649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 885032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 955506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1013170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 230833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 295336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 386284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 388045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 435329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 477370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 590421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 685319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 717263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 766734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 776821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 871228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 897873; code bytes = 803030:T446,Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00001144-00000C2B-1473393731") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")31:T720,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")32:T450,Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in file "00000000-00006328.00000001.159335.00181000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp"33:T22ee,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000008f0068b5960068b59600000000000950467700002a77030000000651467700000000e0eb8f0034292d750000000000000000000000000000000020482d75080000000000000050132e7734292d75000000000800000068b596000000000000000000000000000000000018000000092d76b700000000a0e48f00c4eb8f0058ec8f003017e472953f1cc5feffffff94fc4a7768a89600000095000000000000000000c39be272cceb8f00000000006400000025000b0000539500000000000b0000000000000080a6960067a8960068a89600f052950000009500c4eb8f00aceb8f00a6eb4677000000000000000000000000b0472d75f6dea811e4eb8f00 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000009400b4ef7000d00894007ccf8f00feba467700000000000000000300000048149500b4ef700098cf8f0065094b771300000000000000d06c0477f0b9927513000000accf8f00ae2e48770300000000000000d06c0477bccf8f00e16c04770300000000000000e4cf8f0068205c7603000000000000003ce1b04c70929a750000000024d08f00201b6176ffffffff34d08f0058105c763c105c76ecfeb04c70929a759cb99275f0b9927514d08f0010d08f000d0000000d0000005041b6757cc8ef75000000004041b67530d08f00a8d08f00608d5f76903b573afeffffff40d08f00900f5c765041b67550d08f000625a9757cc8ef755041b6755cd08f00 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000d6d3a811c8e58f00e8899d00c8e88f00b0e8497746057466feffffffe8899d00787f477708bc9a0000000000e8899d000a000b00b6c76c6f000000000000000060a66c6f70a66c6fe8899d0018ee9c0014000000000000000000000008bc9a0000000000f8e68f00d7084677e8899d00000000008403fe7f00000000f000656f00000000094d0b3dec6149775fd6457768030000e8899d000000000034bc9a00180000000000000080e78f0040080000000000000000000000000000010000003d13bd501900000011000000100000000c949b0030a16b6ffeffffff88d095000c949b0000000000000000000000000064e78f00 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000467700004e7303000000065146770000000024dd8f0074a26b74000000000000000000000000000000001b88727409000000000000003082517374a26b740000000009000000c8c29a000000000018000000411a76b786030000d8d58f000000000080df8f003017e472953f1cc5feffffffe0dc8f000a9ae27290dc8f000000000000000000239ae2720cdd8f000000000000000000000000000000000000000000000000000100000000000000010000000000000008dd8f000000000018dd8f00000000000cdd8f00000000000000000000000000cbc9e176b91a76b724dd8f0003f20277b2e9a81128dd8f006eea027700004e7318dd8f0000000000 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000005d0a50ca5d0a000000004cca5d0a020200007b23718fbefc7a1b0000520030df5b8920ca5d0ab0e84977b6187466feffffff30ca5d0a586c95000000f17630fa8473d4474677c54746776eff7a1bccd05d0a8467a100352d19e424ca5d0a70cd5d0ab0ac9973ffffffff64ca5d0a72fa847370cd5d0a7cce767372fa84730100000000000000020000007cce767390ca5d0accd05d0a8467a10080fa84730000000098ca5d0a7c0b067710aa1277612d19e4 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031005d0abefc7a1b5cc95d0abcc95d0a84de5d0a5c0000000eaca1001ccc5d0acaff44770eaca10010ca5d0a5c000000f0aba100c0cc5d0af2ff44770000000000000000352d19e424ca5d0a70cd5d0ab0ac9973ffffffff64ca5d0a72fa84733cca5d0a7cce767372fa84730100000000000000020000007cce767390ca5d0accd05d0ad46ba10080fa8473a29403772a000000f0f99c0000000000612d19e4 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031005d0abefc7a1b5cc95d0abcc95d0a84de5d0a5c000000169aa1001ccc5d0acaff4477169aa10010ca5d0a5c000000f899a100c0cc5d0af2ff44770000000000000000352d19e424ca5d0a70cd5d0ab0ac9973ffffffff64ca5d0a72fa84733cca5d0a7cce767372fa84730100000000000000020000007cce767390ca5d0accd05d0ad46ba10080fa8473a29403772600000048172d0700000000612d19e4 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031005d0abefc7a1b5cc95d0abcc95d0a84de5d0a5c00000096a5a1001ccc5d0acaff447796a5a10010ca5d0a5c00000078a5a100c0cc5d0af2ff44770000000000000000352d19e424ca5d0a70cd5d0ab0ac9973ffffffff64ca5d0a72fa84733cca5d0a7cce767372fa84730100000000000000020000007cce767390ca5d0accd05d0a3463a10080fa8473a29403772900000050009d0000000000612d19e4 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031005d0abefc7a1b5cc95d0abcc95d0a84de5d0a5c0000008ea0a1001ccc5d0acaff44778ea0a10010ca5d0a5c00000070a0a100c0cc5d0af2ff44770000000000000000352d19e424ca5d0a70cd5d0ab0ac9973ffffffff64ca5d0a72fa84733cca5d0a7cce767372fa84730100000000000000020000007cce767390ca5d0accd05d0ae45ea10080fa8473a294037727000000a8182d0700000000612d19e4 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031005d0abefc7a1b5cc95d0abcc95d0a84de5d0a5c0000000eaca1001ccc5d0acaff44770eaca10010ca5d0a5c000000f0aba100c0cc5d0af2ff44770000000000000000352d19e424ca5d0a70cd5d0ab0ac9973ffffffff64ca5d0a72fa84733cca5d0a7cce767372fa84730100000000000000020000007cce767390ca5d0accd05d0acc4fa10080fa8473a29403772a000000f0029d0000000000612d19e4 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031005d0abefc7a1b5cc95d0abcc95d0a84de5d0a5c000000a698a1001ccc5d0acaff4477a698a10010ca5d0a5c0000008898a100c0cc5d0af2ff44770000000000000000352d19e424ca5d0a70cd5d0ab0ac9973ffffffff64ca5d0a72fa84733cca5d0a7cce767372fa84730100000000000000020000007cce767390ca5d0accd05d0acc4fa10080fa8473a294037729000000d0019d0000000000612d19e4 (UID: 00000000-00005528)34:Td52,Found string "select * from Chitietphieunhap" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from f_tbnnn()" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from Chitietphieuxuat" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from f_tbxnn()" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from Dangnhap where TaiKhoan='" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from Phieuxuat" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from f_dsbh2020()" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from NhaSanXuat" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from NhaSanXuat where TenNSX like '%" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from NhaCungCap" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from NhaCungCap where TenNCC like '%" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from ThietBi" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from ThietBi where TenThietbi like '%" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from f_dstbcn()" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "SELECT * FROM fu_SpTheoGia(15000000)" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from LoaiThietbi" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from LoaiThietbi where Tenloai like '%" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from Dangnhap where MatKhau='" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from LoaiThietBi" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from Khachhang" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from NhanVien" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found string "select * from Phieunhap" (Indicator: "select * from "; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe")35:T40c,Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")36:T44e,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE")37:T40c,Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")38:T402,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")39:T187b,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" at 00000000-00005528-00000C17-1461945719 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00005528-00000C17-1462166744 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00005528-00000C17-1462298404 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00005528-00000C17-1463422201 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005528-00000C17-1463576672 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005528-00000C17-1463583375 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005528-00000C17-1463585929 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005528-00000C17-1463588069 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005528-00000C17-1463590421 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005528-00000C17-1463593054 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005528-00000C17-1463595394 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005528-00000C17-1463597672 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005528-00000C17-1463600058 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005528-00000C17-1463602393 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005528-00000C17-1463604724 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005528-00000C17-1463607035 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005528-00000C17-1463609343 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005528-00000C17-1463611774 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005528-00000C17-1463614064 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005528-00000C17-1463616506 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005528-00000C17-1463618965 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005528-00000C17-1463621257 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005528-00000C17-1463623645 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005528-00000C17-1463625933 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005528-00000C17-14636282553a:T409,Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")3b:T5b4e,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MPCLIENT.DLL (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MsMpLics.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\49f607baf81088a9d539c06a3d4f866d\Microsoft.Management.Infrastr (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MPCLIENT.DLL (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MsMpLics.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006328) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter Shell32 (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter Shlwapi.dll (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00001144) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001144)3c:Tc3c,"select * from Chitietphieunhap" (Source: 6000002-Chitietphieunhap~loadData, Indicator: "select * from chitietphieunhap") "insert into Chitietphieunhap values('" (Source: 6000006-Chitietphieunhap~button1_Click, Indicator: "insert into chitietphieunhap values('") "delete from Chitietphieunhap where MaPN='" (Source: 6000007-Chitietphieunhap~button2_Click, Indicator: "delete from chitietphieunhap where mapn='") "select * from f_tbnnn()" (Source: 6000009-Chitietphieunhap~button5_Click, Indicator: "select * from f_tbnnn()"), "select * from Chitietphieuxuat" (Source: 600000e-chitietphieuxuat~loadData, Indicator: "select * from chitietphieuxuat"), "insert into Chitietphieuxuat values('" (Source: 6000012-chitietphieuxuat~button1_Click, Indicator: "insert into chitietphieuxuat values('") "delete from Chitietphieuxuat where MaPX='" (Source: 6000013-chitietphieuxuat~button2_Click, Indicator: "delete from chitietphieuxuat where mapx='") "select * from f_tbxnn()" (Source: 6000015-chitietphieuxuat~button5_Click, Indicator: "select * from f_tbxnn()"), "select * from Dangnhap where TaiKhoan='" (Source: 600001a-Form1~button1_Click, Indicator: "select * from dangnhap where taikhoan='"), "select * from Phieuxuat" (Source: 6000022-Form10~loadData, Indicator: "select * from phieuxuat"), "insert into Phieuxuat values('" (Source: 6000026-Form10~button23_Click, Indicator: "insert into phieuxuat values('") "delete from Phieuxuat where MaPX='" (Source: 6000028-Form10~button24_Click, Indicator: "delete from phieuxuat where mapx='") "select * from f_dsbh2020()" (Source: 600002a-Form10~button2_Click, Indicator: "select * from f_dsbh2020()"), "select * from NhaSanXuat" (Source: 600003b-Form13~loadData, Indicator: "select * from nhasanxuat"), "select * from NhaSanXuat where TenNSX like '%" (Source: 600003e-Form13~button1_Click, Indicator: "select * from nhasanxuat where tennsx like '%"), "select * from NhaCungCap" (Source: 6000043-Form14~loadData, Indicator: "select * from nhacungcap"), "select * from NhaCungCap where TenNCC like '%" (Source: 6000046-Form14~button1_Click, Indicator: "select * from nhacungcap where tenncc like '%"), "select * from ThietBi" (Source: 600004b-Form15~loadData, Indicator: "select * from thietbi"), "select * from ThietBi where TenThietbi like '%" (Source: 600004e-Form15~button1_Click, Indicator: "select * from thietbi where tenthietbi like '%"), "select * from f_dstbcn()" (Source: 6000050-Form15~button4_Click, Indicator: "select * from f_dstbcn()"), "SELECT * FROM fu_SpTheoGia(15000000)" (Source: 6000052-Form15~button6_Click, Indicator: "select * from fu_sptheogia(15000000)"), "select * from LoaiThietbi" (Source: 6000056-Form16~loadData, Indicator: "select * from loaithietbi"), "select * from LoaiThietbi where Tenloai like '%" (Source: 6000059-Form16~button1_Click, Indicator: "select * from loaithietbi where tenloai like '%"), "select * from Dangnhap where MatKhau='" (Source: 600005f-Form17~button1_Click, Indicator: "select * from dangnhap where matkhau='"), "insert into Dangnhap values ('" (Source: 6000063-Form18~button1_Click, Indicator: "insert into dangnhap values ('")3d:T137f2,Found reference to API (Indicator: "GetObject"; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found reference to API (Indicator: "MessageBox"; File: "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "00000000-00006328.00000001.159335.00181000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; File: "00000000-00006328.00000001.159335.00181000.00000020.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SHDeleteKeyW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwCreateSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwMapViewOfSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwClose"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetConsoleOutputCP"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutNameA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseWindow"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumServicesStatusW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "Shell_NotifyIconA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ExtractIconA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "StrToIntA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "PathFileExistsA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "URLDownloadToFileW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "URLOpenBlockingStreamW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005528.00000001.158408.06D70000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp, 00000000-00005528.00000001.158408.6F2EF000.00000002.mdmp, 00000000-00005528.00000001.158408.6F389000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00005528.00000001.158408.06D70000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00005528.00000001.158408.06D70000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00005528.00000001.158408.074B0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp, 00000000-00005528.00000001.158408.6F2EF000.00000002.mdmp, 00000000-00005528.00000001.158408.6F389000.00000002.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp")3e:T704,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")3f:T4d8,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp 00000000-00005528.00000001.158408.07290000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp "USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp40:Tfd1,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 7616-149-0019322A "SOFTWARE\Microsoft\PowerShell\3" in Source: 7616-185-001919AB "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 7616-512-00186400 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 7616-521-00186E30 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 7616-521-00186E30 "SOFTWARE\Microsoft\PowerShell" in Source: 7616-523-00187130 "Software\Classes\mscfile\shell\open\command" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "\Opera Software\Opera Stable\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Rmc-JQX1JF\" in Source: 00000000-00001144.00000000.158712.01590000.00000004.mdmp 00000000-00001144.00000001.160633.01590000.00000004.mdmp 00000000-00001144.00000002.162553.01590000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005528.00000000.157935.00950000.00000004.mdmp 00000000-00005528.00000001.158408.00977000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005528.00000000.157935.00950000.00000004.mdmp 00000000-00005528.00000001.158408.00977000.00000004.mdmp "YSTEM\Software\Microsoft\" in Source: 00000000-00005528.00000001.158408.008F7000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp "\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled" in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp41:Tc1a,Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5528:168:WilStaging_02" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5528:64:WilError_03" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "Local\SM0:5528:168:WilStaging_02" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "Local\SM0:5528:64:WilError_03" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "SM0:5528:64:WilError_03" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "Local\ZonesCacheCounterMutex" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5528:64:WilError_03" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6328:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:6328:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6328:64:WilError_03" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:6328:64:WilError_03" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6328:64:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6328:64:WilError_03" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Rmc-JQX1JF" Process 7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe created mutex with name "Rmc-JQX1JF"42:T16b5,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]43:T3a76,"Software\Classes\mscfile\shell\open\command" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "Software\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "\Opera Software\Opera Stable\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp "Software\Rmc-JQX1JF\" in Source: 00000000-00001144.00000000.158712.01590000.00000004.mdmp "Software\Classes\mscfile\shell\open\command" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "Software\" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "\Opera Software\Opera Stable\" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00001144.00000001.160633.00400000.00000040.mdmp "Software\Rmc-JQX1JF\" in Source: 00000000-00001144.00000001.160633.01590000.00000004.mdmp "Software\Classes\mscfile\shell\open\command" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "\Opera Software\Opera Stable\" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00001144.00000002.162553.00400000.00000040.mdmp "Software\Rmc-JQX1JF\" in Source: 00000000-00001144.00000002.162553.01590000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005528.00000000.157935.00950000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005528.00000000.157935.00950000.00000004.mdmp "YSTEM\Software\Microsoft\" in Source: 00000000-00005528.00000001.158408.008F7000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp "\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled" in Source: 00000000-00005528.00000001.158408.07290000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "HKLM\" in Source: 00000000-00005528.00000001.158408.6F211000.00000020.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005528.00000001.158408.6F351000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005528.00000001.158408.6F351000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005528.00000001.158408.6F351000.00000020.mdmp "e\Software\Cla" in Source: 00000000-00006328.00000000.158638.02830000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006328.00000000.158638.04670000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006328.00000001.159335.00181000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006328.00000001.159335.00181000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006328.00000001.159335.00181000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006328.00000001.159335.00181000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006328.00000001.159335.00181000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006328.00000001.159335.00181000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00006328.00000001.159335.024C7000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006328.00000001.159335.0284E000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006328.00000001.159335.0284E000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00006328.00000001.159335.0284E000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006328.00000001.159335.0291D000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006328.00000001.159335.041A0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006328.00000001.159335.041A0000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\System\DNSClient" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\Registry\Machine\Software\WOW6432Node\Policies\Microsoft\System\DNSClient" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-1938232448-381239\Registry\Machine\Software\WOW6432Node\Policies\Microsoft\System\DNSClient" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\System" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\System" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REG\REGISTRY\USER\S-1-5-21-1271187874-1938232448-38123922\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\System" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Sof\Registry\Machine\Software\WOW6432Node\Policies\Microsoft\System\DNSClient" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Diagnostics" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Regi\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Diagnostics" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-19382324\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\R\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "\REG\REGISTRY\USER\S-1-5-21-12711878\RE\Registry\Machine\Registry\Machine\Software\WOW6432Node\Policies\Microsoft\System\DNSClientq" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "REGISTRY\MACHINE\Software\Microsoft\OleAut" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\System" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\Software\Policies\Microsoft\System\DNSClient" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00006328.00000001.159335.042C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00006328.00000001.159335.08502000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006328.00000001.159335.08502000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006328.00000001.159335.08502000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00006328.00000001.159335.6FED1000.00000020.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00006328.00000001.159335.6FED1000.00000020.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00006328.00000001.159335.6FED1000.00000020.mdmp44:T559b,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "KERNEL32" at base 760a0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75200000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "ADVAPI32.DLL" at base 77390000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72fa0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "SHLWAPI.DLL" at base 77240000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74900000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "VERSION.DLL" at base 75110000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72650000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "USER32.DLL" at base 769b0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "MSCOREE.DLL" at base 73100000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76190000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "PSAPI.DLL" at base 77290000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "RPCRT4.DLL" at base 76710000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "KERNEL32.DLL" at base 760a0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\8D55D7CAD944A3F21AEB1DB491F3D6DE\MSCORLIB.NI.DLL" at base 71240000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "OLE32.DLL" at base 75310000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74920000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76190000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 711c0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 707a0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "UXTHEME.DLL" at base 74920000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 6ff80000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\E4E680611F69D26D704E61DD8BFA4ECE\SYSTEM.CONFIGURATION.NI.DLL" at base 6fe70000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 6f700000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "NTDLL.DLL" at base 77420000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "SHELL32.DLL" at base 75900000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "BCRYPT.DLL" at base 72ea0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72e70000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "IMM32.DLL" at base 75200000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "COMCTL32.DLL" at base 6f650000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "GDI32.DLL" at base 752d0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "GDIPLUS.DLL" at base 746b0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL" at base 746b0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "WLDP.DLL" at base 6f3e0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "AMSI.DLL" at base 6f3c0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75110000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 6f350000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSWOW64\AUZ84K6I.DLL" at base 6f310000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPCLIENT.DLL" at base 6f210000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 760a0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77390000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "WINDOWSCODECS.DLL" at base 734e0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "NTDLL" at base 77420000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "SSPICLI.DLL" at base 73e10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6ee80000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73710000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ed0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6ee00000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74200000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "VIRTDISK.DLL" at base 745c0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 73640000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 73640000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 6ed80000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6eab0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "KERNELBASE" at base 76f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76f10000 "powershell.exe" loaded module "KERNEL32" at base 760a0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 77390000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72fa0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 77240000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74900000 "powershell.exe" loaded module "VERSION.DLL" at base 75110000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72650000 "powershell.exe" loaded module "USER32.DLL" at base 769b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 73100000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76190000 "powershell.exe" loaded module "PSAPI.DLL" at base 77290000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76710000 "powershell.exe" loaded module "KERNEL32.DLL" at base 760a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\8D55D7CAD944A3F21AEB1DB491F3D6DE\MSCORLIB.NI.DLL" at base 71240000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 75310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76be0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72e80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76030000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 711a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 70780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 6ff60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 76190000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77420000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75900000 "powershell.exe" loaded module "AMSI.DLL" at base 6ff40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75110000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPOAV.DLL" at base 6fed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 6f760000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 75fd0000 "powershell.exe" loaded module "WLDP.DLL" at base 6f710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 768a0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\AUZ84K6I.DLL" at base 6f6d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f6b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\49F607BAF81088A9D539C06A3D4F866D\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f600000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f5e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f590000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\PWRSHSIP.DLL" at base 6f580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f220000 "powershell.exe" loaded module "CRYPT32.DLL" at base 768a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\E4E680611F69D26D704E61DD8BFA4ECE\SYSTEM.CONFIGURATION.NI.DLL" at base 6f110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76190000 "powershell.exe" loaded module "BCRYPT.DLL" at base 71220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f0c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6f0b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73e10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74920000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\X86\MPCLIENT.DLL" at base 6efb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 760a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77390000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 74200000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76f10000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 745c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6ef00000 "powershell.exe" loaded module "OLEAUT32" at base 76be0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 76f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 767d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6eef0000 "powershell.exe" loaded module "MI.DLL" at base 6eed0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 76f10000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6ee40000 "powershell.exe" loaded module "GDI32.DLL" at base 752d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76f10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ee20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ed90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ecc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 760a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "SHELL32" at base 75900000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76f10000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 766b0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73160000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72eb0000 "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" loaded module "C:\7A1BB4FE0F62425FDD2E163EA17D84465323C4F2DF8AABB8A50B1433E7D42A9F.EXE" at base 40000045:Tc3c,"select * from Chitietphieunhap" (Source: 6000002-Chitietphieunhap~loadData, Indicator: "select * from chitietphieunhap") "insert into Chitietphieunhap values('" (Source: 6000006-Chitietphieunhap~button1_Click, Indicator: "insert into chitietphieunhap values('") "delete from Chitietphieunhap where MaPN='" (Source: 6000007-Chitietphieunhap~button2_Click, Indicator: "delete from chitietphieunhap where mapn='") "select * from f_tbnnn()" (Source: 6000009-Chitietphieunhap~button5_Click, Indicator: "select * from f_tbnnn()"), "select * from Chitietphieuxuat" (Source: 600000e-chitietphieuxuat~loadData, Indicator: "select * from chitietphieuxuat"), "insert into Chitietphieuxuat values('" (Source: 6000012-chitietphieuxuat~button1_Click, Indicator: "insert into chitietphieuxuat values('") "delete from Chitietphieuxuat where MaPX='" (Source: 6000013-chitietphieuxuat~button2_Click, Indicator: "delete from chitietphieuxuat where mapx='") "select * from f_tbxnn()" (Source: 6000015-chitietphieuxuat~button5_Click, Indicator: "select * from f_tbxnn()"), "select * from Dangnhap where TaiKhoan='" (Source: 600001a-Form1~button1_Click, Indicator: "select * from dangnhap where taikhoan='"), "select * from Phieuxuat" (Source: 6000022-Form10~loadData, Indicator: "select * from phieuxuat"), "insert into Phieuxuat values('" (Source: 6000026-Form10~button23_Click, Indicator: "insert into phieuxuat values('") "delete from Phieuxuat where MaPX='" (Source: 6000028-Form10~button24_Click, Indicator: "delete from phieuxuat where mapx='") "select * from f_dsbh2020()" (Source: 600002a-Form10~button2_Click, Indicator: "select * from f_dsbh2020()"), "select * from NhaSanXuat" (Source: 600003b-Form13~loadData, Indicator: "select * from nhasanxuat"), "select * from NhaSanXuat where TenNSX like '%" (Source: 600003e-Form13~button1_Click, Indicator: "select * from nhasanxuat where tennsx like '%"), "select * from NhaCungCap" (Source: 6000043-Form14~loadData, Indicator: "select * from nhacungcap"), "select * from NhaCungCap where TenNCC like '%" (Source: 6000046-Form14~button1_Click, Indicator: "select * from nhacungcap where tenncc like '%"), "select * from ThietBi" (Source: 600004b-Form15~loadData, Indicator: "select * from thietbi"), "select * from ThietBi where TenThietbi like '%" (Source: 600004e-Form15~button1_Click, Indicator: "select * from thietbi where tenthietbi like '%"), "select * from f_dstbcn()" (Source: 6000050-Form15~button4_Click, Indicator: "select * from f_dstbcn()"), "SELECT * FROM fu_SpTheoGia(15000000)" (Source: 6000052-Form15~button6_Click, Indicator: "select * from fu_sptheogia(15000000)"), "select * from LoaiThietbi" (Source: 6000056-Form16~loadData, Indicator: "select * from loaithietbi"), "select * from LoaiThietbi where Tenloai like '%" (Source: 6000059-Form16~button1_Click, Indicator: "select * from loaithietbi where tenloai like '%"), "select * from Dangnhap where MatKhau='" (Source: 600005f-Form17~button1_Click, Indicator: "select * from dangnhap where matkhau='"), "insert into Dangnhap values ('" (Source: 6000063-Form18~button1_Click, Indicator: "insert into dangnhap values ('")46:T1cc7,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Activation Layout Preferences" (Path: "HKCU\WOW6432NODE\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")47:T4c1,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"48:T997,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")49:Tf43,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005528-00000C2A-1460976382] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005528-00000C2A-1461465651] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005528-00000C2A-1461597019] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005528-00000C2A-1461671260] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll" [Source: 00000000-00005528-00000C2A-1461912704] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005528-00000C2A-1461946614] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005528-00000C2A-1462023782] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005528-00000C2A-1462129457] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005528-00000C2A-1462173794] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll" [Source: 00000000-00005528-00000C2A-1462258895] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005528-00000C2A-1462393049] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll" [Source: 00000000-00005528-00000C2A-1462552274] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll" [Source: 00000000-00005528-00000C2A-1462586607] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll" [Source: 00000000-00005528-00000C2A-1462636100] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005528-00000C2A-1463065607] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005528-00000C2A-1464227348] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005528-00000C2A-1464260778] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005528-00000C2A-1464308494] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005528-00000C2A-1467641859] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00005528-00000C2A-1468141673] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005528-00000C2A-1468202022] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005528-00000C2A-1469770190] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" [Source: 00000000-00005528-00000C2A-1469906558] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006328-00000C2A-1474064642] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006328-00000C2A-1474359796]4a:Td4d,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1944" "BaseAddress": "023DA1E8" "Buffer": "0A5DE56C" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2012" "BaseAddress": "031DE1E8" "Buffer": "008FC70C" "NumberOfBytesToWrite": "00000004" "$name": "C:\\Windows\\SysWOW64\\schtasks.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "0107A1E8" "Buffer": "008FCB04" "NumberOfBytesToWrite": "00000004" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "00400000" "Buffer": "04C5A430" "NumberOfBytesToWrite": "00000400" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "00401000" "Buffer": "04CD0050" "NumberOfBytesToWrite": "00054800" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "00456000" "Buffer": "0415DE18" "NumberOfBytesToWrite": "00017600" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "0046E000" "Buffer": "02F1C9DC" "NumberOfBytesToWrite": "00000E00" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "00474000" "Buffer": "02F1D7E8" "NumberOfBytesToWrite": "00000200" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "00475000" "Buffer": "02F1D9F4" "NumberOfBytesToWrite": "00000400" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "00476000" "Buffer": "02F1DE0C" "NumberOfBytesToWrite": "00004C00" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"} "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2000" "BaseAddress": "0047B000" "Buffer": "02F22A24" "NumberOfBytesToWrite": "00003A00" "$name": "C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe"}4b:T44c,"StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006328] "tmpBEF6.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmpBEF6.tmp]- [targetUID: 00000000-00005528] "logs.dat" has type "data"- Location: [%APPDATA%\logs.dat]- [targetUID: 00000000-00001144] "__PSScriptPolicyTest_w01a5oel.lmt.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_w01a5oel.lmt.psm1]- [targetUID: 00000000-00006328] "__PSScriptPolicyTest_0xdm53ns.inh.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_0xdm53ns.inh.ps1]- [targetUID: 00000000-00006328] "__PSScriptPolicyTest_fmufs4kt.xvw.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_fmufs4kt.xvw.ps1]- [targetUID: 00000000-00006328] "__PSScriptPolicyTest_ex5zsdxr.txk.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_ex5zsdxr.txk.psm1]- [targetUID: 00000000-00006328]4c:T89b,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\7A1BB4FE0F62425FDD2E163EA17D84465323C4F2DF8AABB8A50B1433E7D42A9F.EXE"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}\"; Key: ""; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "")4d:T14eb,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "DATA"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "")4e:T47f,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\8d55d7cad944a3f21aeb1db491f3d6de\mscorlib.ni.dll.aux" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\10e5a0803d11b8b826dbeb56a1f98239\system.ni.dll.aux" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\e4e680611f69d26d704e61dd8bfa4ece\system.configuration.ni.dll.aux" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\53fcc36b6b7c9cc86e5d7484c1f93bd8\system.core.ni.dll.aux" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\638ba173c955ab83f37edbab9b896f44\system.xml.ni.dll.aux"4f:T41b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify virtual environment by using API string Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Possibly tries to evade analysis by sleeping many times50:T6aa,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\rpcrt4.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\ws2_32.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll"51:Te9b,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\profapi.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\DWrite.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\SysWOW64\MsMpLics.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WindowsCodecs.dll" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll"52:Tae8,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe.config" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\tocehi" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.INI" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe.Local\" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Accessibility" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.INI" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI" "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data"53:T4c2,Heuristic match: "'k.cm" Heuristic match: "on.ge" Heuristic match: "|+.bj" Heuristic match: "g..fj" Heuristic match: "ln.io" Heuristic match: "1;.pt" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "gdyhjjdhbvxgsfe.gotdns.ch" Heuristic match: "_cmdletization_methodparameter = [microsoft.powershell.cmdletization.methodparameter]@{name = 'controlledfolderaccessallowedapplications'; parametertype = 'system.string[]'; bindings = 'in'; value = $__cmdletization_value; isvaluepresent = $true} } " Heuristic match: "[object]$__cmdletization_defaultvalue = $null [object]$__cmdletization_defaultvalueispresent = $false if ($psboundparameters.containskey('disablesshparsing')) { [object]$__cmdletization_value = ${disablesshparsing} $__cmdlet" Pattern match: "http://geoplugin.net/json.gp" Heuristic match: "breakingsecurity.net" Heuristic match: "dyhjjdhbvxgsfe.gotdns.ch" Heuristic match: "tdns.ch" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "//sajatypeworks.com" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&"54:T3082,Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00001144.00000001.160633.00400000.00000040.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmpupdateservice77bdaf73-b396-481f-9042-ad358843ec24indows" - Source: "00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005528.00000001.158408.6F211000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlhttpupdatealtlocationforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalnissignatureslastupdatedlastemergencysigcheckenableemergencysigsdeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005528.00000001.158408.6F211000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutlastmapssuccesstimelastmapsfailuretimethreatseveritydefaultactiontsstatetsstarttimetsexpirationtimetssourcetsdailyquotadisableprivacymodeallowuseruiaccessuilockdownadvertiselastschedulednotification_suppresssuppressrebootnotificationsuppresswdonotificationpauseupdatestarttimepauseupdateexpirationtimelastheartbeatsystimedisablelastaccesstimesuppressioninternalforceuupproxyforceignorecachedisableinjectiondisableasyncscanoncloseasynconopenvolumesenablertpasyncthrottlingrtpasyncthrottlepercentvaluedlpshowdialogsenablebrowserpasteenforcementdlpdisableprintfileheuristicdlpdisablebrowsercachedisablecopyaccelerationforsessionzerodisabletpexclusionsdynamicinjectionthresholdforcopyaccelerationdynamicinjectiontimewindowforcopyaccelerationdlpbrowsercachecleanupintervaldlpbrowserstalecachecleanupintervaldlpbrowsercloudegressbypassdurationpreventplatformupdatefilterexperimentmodecopyacceleratorcancellablecopysupportmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllrevious_corrupted_tpconfigsnapshot.snptspreferenceconfigs.snptspolicyconfigs.snpfailed" - Source: "00000000-00005528.00000001.158408.6F211000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00005528.00000001.158408.6F351000.00000020.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006328.00000001.159335.06F70000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.23.43.1.4.9@eckp1.3.132.0.33ecdp2.23.43.1.4.9ecdpciv" - Source: "00000000-00006328.00000001.159335.06F70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006328.00000001.159335.06F70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00006328.00000001.159335.06F70000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006328.00000001.159335.06F9B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006328.00000001.159335.06F9B000.00000004.mdmp") Found URL "http://crl.microsoft.com6,,gu" - Source: "00000000-00006328.00000001.159335.06F9B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwrapnonexceptionthrowsmicrosoft" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0uksuswbx6syy'q\y-g" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0%" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0et,@858chz$31zof1gwanjat^r" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00006328.00000001.159335.07061000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006328.00000001.159335.084F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0.5y7$cg7'x" - Source: "00000000-00006328.00000001.159335.084F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>b:q" - Source: "00000000-00006328.00000001.159335.084F3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l$qttjqttjqt]:qt]:q$q8^:q8^:q$qd^:qd^:qx^:qx^:q" - Source: "00000000-00006328.00000001.159335.08502000.00000004.mdmp") Found URL "http://www.microsoft.c" - Source: "00000000-00006328.00000001.159335.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006328.00000001.159335.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0.5y7$cg7'x" - Source: "00000000-00006328.00000001.159335.08502000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0('" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.bt.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microod>dozd@k" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://crl.microsoft*/crl/products/microoceraut_2010-06-23.crl0zn0l0jb:q@8" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.a10(1$fr_g?b:^" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$w" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0.5y7$cg7'x" - Source: "00000000-00006328.00000001.159335.08563000.00000004.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0.5y7$cg7'x" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zlc:q4n:q" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinprop011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0acrosoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-1heapwashington1redmond1microsoft" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkioa201(y'k" - Source: "00000000-00006328.00000001.159335.085A4000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00006328.00000001.159335.6FED1000.00000020.mdmp")55:T6ef,Found registry query API: "RegQueryValueExW" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp"56:Teac,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005528) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005528)57:T126d,Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; File: "AMSI") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "AMSI") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; File: "00000000-00006328.00000001.159335.00181000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; File: "00000000-00006328.00000001.159335.00181000.00000020.mdmp") Found string "ZipFiles" (Indicator: "zipfile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "UnzipFiles" (Indicator: "zipfile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "SHA256wECDSA" (Indicator: "ecdsa"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes128"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp, 00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp, 00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00005528.00000001.158408.06D70000.00000004.mdmp, 00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00005528.00000001.158408.06D70000.00000004.mdmp, 00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00005528.00000001.158408.06D70000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp")58:T4f2,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")59:Tac9,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00005528.00000001.158408.07970000.00000004.mdmp")5a:T89b,Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp")5b:T44e,Found string "where MaPN= '" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where MaPX= '" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where TaiKhoan='" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where MaNSX= '" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where MaNCC= '" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where Mathietbi='" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where Maloai= '" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where MaKhachhang= '" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp") Found string "where MaNhanVien= '" (Indicator: "where "; Source: "00000000-00001144.00000001.160633.00E12000.00000002.mdmp")5c:T41a,Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")5d:T1297,Found string "[Tab]" (Indicator: "[tab]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[Alt]" (Indicator: "[alt]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[Alt]" (Indicator: "[Alt]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[Pause]" (Indicator: "[pause]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[Esc]" (Indicator: "[esc]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[End]" (Indicator: "[end]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[Left]" (Indicator: "[left]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[Right]" (Indicator: "[right]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[Down]" (Indicator: "[down]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found string "[F12]" (Indicator: "[F12]"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp")5e:T14ec,Found string "\Device\HarddiskVolume3\Windows\SysWOW64\schtasks.exe" (Indicator: "\Device\"; Source: "00000000-00005528-00000BC0-1471136237") Found string "\Device\HarddiskVolume3\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Indicator: "\Device\"; Source: "00000000-00005528-00000BC0-1472097216") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001144.00000000.158712.01590000.00000004.mdmp, 00000000-00001144.00000001.160633.01590000.00000004.mdmp, 00000000-00001144.00000001.160633.03050000.00000004.mdmp, 00000000-00001144.00000002.162553.01590000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001144.00000000.158712.01590000.00000004.mdmp, 00000000-00001144.00000001.160633.01590000.00000004.mdmp, 00000000-00001144.00000001.160633.03050000.00000004.mdmp, 00000000-00001144.00000002.162553.01590000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001144.00000000.158712.01590000.00000004.mdmp, 00000000-00001144.00000001.160633.01590000.00000004.mdmp, 00000000-00001144.00000002.162553.01590000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001144.00000000.158712.01590000.00000004.mdmp, 00000000-00001144.00000001.160633.01590000.00000004.mdmp, 00000000-00001144.00000002.162553.01590000.00000004.mdmp") Found string "ws\System32\Drivers" (Indicator: "system32\drivers"; Source: "00000000-00001144.00000000.158712.01590000.00000004.mdmp, 00000000-00001144.00000001.160633.01590000.00000004.mdmp, 00000000-00001144.00000002.162553.01590000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001144.00000000.158712.01C20000.00000002.mdmp, 00000000-00001144.00000001.160633.01C20000.00000002.mdmp, 00000000-00001144.00000002.162553.01C20000.00000002.mdmp") Found string "tWindows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001144.00000001.160633.03050000.00000004.mdmp") Found string "tWindows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001144.00000001.160633.03050000.00000004.mdmp") Found string "s\System32\Drivers\DriverDat" (Indicator: "\drivers\"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp") Found string "s\System32\Drivers\DriverDat" (Indicator: "system32\drivers"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp, 00000000-00005528.00000000.157935.00C80000.00000004.mdmp, 00000000-00005528.00000000.157935.02AA0000.00000004.mdmp, 00000000-00005528.00000000.157935.053D0000.00000004.mdmp, 00000000-00005528.00000001.158408.00950000.00000004.mdmp, 00000000-00005528.00000001.158408.00977000.00000004.mdmp, 00000000-00005528.00000001.158408.00C80000.00000004.mdmp, 00000000-00005528.00000001.158408.02AA0000.00000004.mdmp, 00000000-00005528.00000001.158408.053D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp, 00000000-00005528.00000000.157935.00C80000.00000004.mdmp, 00000000-00005528.00000000.157935.02AA0000.00000004.mdmp, 00000000-00005528.00000000.157935.053D0000.00000004.mdmp, 00000000-00005528.00000001.158408.00950000.00000004.mdmp, 00000000-00005528.00000001.158408.00977000.00000004.mdmp, 00000000-00005528.00000001.158408.00C80000.00000004.mdmp, 00000000-00005528.00000001.158408.02AA0000.00000004.mdmp, 00000000-00005528.00000001.158408.053D0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005528.00000000.157935.00950000.00000004.mdmp, 00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005528.00000000.157935.015B0000.00000002.mdmp") Found string "stem32\Drivers\DriverDat" (Indicator: "\drivers\"; Source: "00000000-00005528.00000001.158408.00950000.00000004.mdmp") Found string "\Device\HarddiskVolume3" (Indicator: "\Device\"; Source: "00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found string "e3\DosDevices\C" (Indicator: "\DosDevices\"; Source: "00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found string "e3\DosDevices\C:\??\Volume{" (Indicator: "\DosDevices\"; Source: "00000000-00005528.00000001.158408.00977000.00000004.mdmp") Found string "Device\HarddiskVolume3\DosDevices\C:\??\Volume{44294f7c-6083-41c6-8176-3c202d755616}0008" (Indicator: "\DosDevices\"; Source: "00000000-00005528.00000001.158408.07290000.00000004.mdmp") Found string "Device\HarddiskVolume3\DosDevices\C:\??\Volume{44294f7c-6083-41c6-8176-3c202d755616}e-f" (Indicator: "\DosDevices\"; Source: "00000000-00005528.00000001.158408.07290000.00000004.mdmp")5f:T735,Found reference to API "fso.DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp"), Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp"), Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp"), Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001144.00000000.158712.00400000.00000040.mdmp 00000000-00001144.00000001.160633.00400000.00000040.mdmp 00000000-00001144.00000002.162553.00400000.00000040.mdmp")60:Tb00,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\SCHTASKS.EXE"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\7A1BB4FE0F62425FDD2E163EA17D84465323C4F2DF8AABB8A50B1433E7D42A9F.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "")61:T7ad,"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1944) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 2012) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00000004 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00000400 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00054800 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00017600 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00000E00 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00000200 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00004C00 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000) "7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" wrote 00003A00 bytes to a remote process "C:\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe" (Handle: 2000)62:Tdd5,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005900.00000000.284417.03270000.00000004.mdmp, 00000000-00005900.00000000.284417.077F0000.00000004.mdmp, 00000000-00005900.00000001.284944.03270000.00000004.mdmp, 00000000-00005900.00000001.284944.077F0000.00000004.mdmp, 00000000-00005900.00000001.284944.08DD0000.00000004.mdmp") Found string "wsPowerShell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00005900.00000000.284417.03270000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005900.00000000.284417.03270000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00005900.00000000.284417.03270000.00000004.mdmp, 00000000-00005900.00000001.284944.03270000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005900.00000000.284417.03270000.00000004.mdmp, 00000000-00005900.00000001.284944.03270000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", $env:TEMP)" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($exception,"FormatHexFileAccessError", ([System.Management.Automation.ErrorCategory]::ReadError), $targetFilePath)" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidData" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$ast = [System.Management.Automation.Language.Parser]::ParseFile(($resolvedPath.ProviderPath), [ref] $null, [ref] $parseErrors)" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$data = $ast.Find( { $args[0] -is [System.Management.Automation.Language.HashtableAst] }, $false )" (Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "System.Management.Automationa" (Source: "00000000-00005900.00000001.284944.077F0000.00000004.mdmp") Found string "/System.Management.Automation.resources/System.Management.Automation.resources" (Source: "00000000-00005900.00000001.284944.08DD0000.00000004.mdmp") Found string "file:///C:/Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00005900.00000001.284944.08DD0000.00000004.mdmp")63:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}64:T809,Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Indicator: "Write-Error"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00005900.00000000.284417.077F0000.00000004.mdmp")65:T645,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.03270000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.03270000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.03270000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00005900.00000001.284944.09050000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.09050000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00005900.00000001.284944.09090000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00005900.00000001.284944.09090000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.090B0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.090F0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.090F0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.090F0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00005900.00000001.284944.090F0000.00000004.mdmp")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792163479888,"unified_at":"2026-10-16T15:11:19.888Z","metadata":{"hashes":{"sha256":"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f","sha1":"822ce06e4eb9679158646050d3ec6f11754e273d","md5":"c96f60219124ec01111cf884ffd1d2d9","sha512":"bf53cc329a2b3efe2614b56b1b6c36db9e032764445f6e12cc9b40c6bde573ea0419e152f961ebc36a58c2ab8fe22bb47044854c0c0f302979b311f257e6dabe","ssdeep":"24576:tUGyQ07lzzMu7t3vW4ESTFENAUaTRf60r:txIlPj7OSTFEaX","ssdeep_chunks":["24576:tUGyQ07","24576:UGyQ07l","24576:GyQ07lz","24576:yQ07lzz","24576:Q07lzzM","24576:07lzzMu","24576:7lzzMu7","24576:lzzMu7t","24576:zzMu7t3","24576:zMu7t3v","24576:Mu7t3vW","24576:u7t3vW4","24576:7t3vW4E","24576:t3vW4ES","24576:3vW4EST","24576:vW4ESTF","24576:W4ESTFE","24576:4ESTFEN","24576:ESTFENA","24576:STFENAU","24576:TFENAUa","24576:FENAUaT","24576:ENAUaTR","24576:NAUaTRf","24576:AUaTRf6","24576:UaTRf60","24576:aTRf60r","49152:tUGyQ07","49152:UGyQ07l","49152:GyQ07lz","49152:yQ07lzz","49152:Q07lzzM","49152:07lzzMu","49152:7lzzMu7","49152:lzzMu7t","49152:zzMu7t3","49152:zMu7t3v","49152:Mu7t3vW","49152:u7t3vW4","49152:7t3vW4E","49152:t3vW4ES","49152:3vW4EST","49152:vW4ESTF","49152:W4ESTFE","49152:4ESTFEN","49152:ESTFENA","49152:STFENAU","49152:TFENAUa","49152:FENAUaT","49152:ENAUaTR","49152:NAUaTRf","49152:AUaTRf6","49152:UaTRf60","49152:aTRf60r","24576:txIlPj7","24576:xIlPj7O","24576:IlPj7OS","24576:lPj7OST","24576:Pj7OSTF","24576:j7OSTFE","24576:7OSTFEa","24576:OSTFEaX"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"sample.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1015808,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1683314107000,"last_seen":1763544037000,"last_multi_scan":1763544037000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","commodity","criminal","rat","remcos","infostealer"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":105},"sandbox_signatures":{"informative_count":266,"suspicious_count":15,"malicious_count":17,"total":298},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.AgentTesla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Sabsik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.MSIL.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Loki.EBZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Loki.EBZ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Rescoms.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.AgentTesla.ku","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d5f371 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agensla.jwexds","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ABH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"PWS-FDQG!C96F60219124","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.COT.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_52.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agensla.Win32.24817","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Loki","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"},{"type":"malicious","value":"Schedules a task to be executed from task XML file"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"YARA signature match - LNK file executes using PowerShell"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"},{"type":"informative","value":"YARA signature match - High entropy file"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve security identifier (.NET)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve default system language settings"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"malicious","value":"Able to use RSA keys for encryption and decryption"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"ZipFiles\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found string \"GZipStream\" (Source: \"00000000-00005528.00000001.158408.06D70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\AIKg\" (Indicator: \"add-mppreference\"; Source: \"00000000-00005528-00000C46-26039274294\"), Found reference string \"Add-MpPreference -ExclusionPath C:\\Users\\HAPUBWS\\AppData\\Roaming\\AIKgmyycVaEjJx.exe\" (Indicator: \"add-mppreference\"; File: \"AMSI\"), Found reference string \"Add-MpPreference -ExclusionPath \"%APPDATA%\\AIKgmyycVaEjJx.exe\"\" (Indicator: \"add-mppreference\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"LoadResource with parameter {'hModule': '114491393', 'hResInfo': '114492640'}\" (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"LoadResource with parameter {'hModule': '114491393', 'hResInfo': '114492672'}\" (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"LoadResource with parameter {'hModule': '114491393', 'hResInfo': '114492688'}\" (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"LoadResource with parameter {'hModule': '114491393', 'hResInfo': '114492656'}\" (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00005528.00000001.158408.00977000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001144.00000001.160633.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005528.00000001.158408.06D70000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005528.00000001.158408.074B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005528.00000001.158408.0A4E0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006328-7616-55-00189794\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006328-7616-490-00189C70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NtUpdateWnfStateData@NTDLL.DLL at 00000000-00006328-7616-242-0018FDEB\n Found reference to API NtQueryWnfStateData@NTDLL.DLL at 00000000-00006328-7616-251-0018FD90\n Found reference to API RtlUnregisterFeatureConfigurationChangeNotification@NTDLL.DLL at 00000000-00006328-7616-261-0018AC06\n Found reference to API RtlRegisterFeatureConfigurationChangeNotification@NTDLL.DLL at 00000000-00006328-7616-313-0019002E\n Found reference to API RtlQueryFeatureConfiguration@NTDLL.DLL at 00000000-00006328-7616-314-0018FFD5\n Found reference to API RtlNotifyFeatureUsage@NTDLL.DLL at 00000000-00006328-7616-315-0018FF8B\n Found reference to API RtlNtStatusToDosErrorNoTeb@NTDLL.DLL at 00000000-00006328-7616-436-0018DF00\n Found reference to API RtlDllShutdownInProgress@NTDLL.DLL at 00000000-00006328-7616-437-0018DE80\n Found reference to API RtlDisownModuleHeapAllocation@NTDLL.DLL at 00000000-00006328-7616-438-0018DE00","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005528.00000001.158408.06D70000.00000004.mdmp, 00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005528.00000000.157935.00950000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.8154","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005528-00000C2B-1462704353\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006328-00000C2B-1476332530\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005528-00000C2B-1462704353\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006328-00000C2B-1476332530\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005528-00000C2B-1463252856\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005528-00000C2B-1461669702\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005528-00000C2B-1461670342\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005528-00000C2B-1469885358\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005528-00000C2B-1469885397\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusW\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001144-00000C2B-1474024175\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameA\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00005528-00000C2B-1470143655\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005528-00000C2B-1470143694\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006328-00000C2B-1476220505\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006328-00000C2B-1476220549\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001144)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"IsWow64Process\" with parameter \"5528\" - (UID: 00000000-00005528)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"6328\" - (UID: 00000000-00006328)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"IsWow64Process\" with parameter \"1144\" - (UID: 00000000-00001144)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"EnumWindows\" with parameter \"173930240\" - (UID: 00000000-00005528)\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"EnumWindows\" with parameter \"9427100\" - (UID: 00000000-00005528)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetWindowTextW\" with parameter \"Program Manager\" - (UID: 00000000-00001144)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000f95e6f0000000011000000f0f15e6f8000000000000000000063020c000000000000000000000008ca4c02feba467700000000000000008000000080325e6f28ca4c022d83817600006302000000008000000080325e6f02000000ec135e6f40ca4c028b325e6f80000000b4375e6f01000000a8e45e6f6cca4c0241345e6f (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005528)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006328)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005528)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006328)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00006328-7616-481-00189EC9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00006328-7616-186-00191F5C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$34","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006328-7616-481-00189EC9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006328-7616-481-00189EC9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00006328-7616-143-001932ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoEx@KERNEL32.DLL at 00000000-00006328-7616-147-001934EC\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00006328-7616-151-001931C3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$36","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00005528.00000000.157935.00950000.00000004.mdmp\n 00000000-00005528.00000001.158408.00977000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00006328-7616-137-001937F7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-189-00191900\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-191-0018DA59\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-218-0018AAA7\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-219-0018B109\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-231-0018DAC7\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-236-0018B7D0\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-325-0018F392\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-327-0018F7E1\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-331-0018CF72\n GetProcessHeap@KERNEL32.DLL at 00000000-00006328-7616-428-0018DF74","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006328-00000C17-1479504217","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyW\" in \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\"\n Found registry modification API: \"RegCreateKeyA\" in \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005528)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CopyFileW\" to copy C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe to new location %APPDATA%\\AIKgmyycVaEjJx.exe (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\AIKg\" - (UID: 00000000-00005528), \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\AIKgmyycVaEjJx\" /XML \"%TEMP%\\tmpBEF6.tmp\"\" - (UID: 00000000-00005528), \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CreateProcessA\" with parameter \"C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" - (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134080465363112632.6328.DefaultAppDomain.powershell\" - (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005528.00000001.158408.06D70000.00000004.mdmp, 00000000-00005528.00000001.158408.074B0000.00000004.mdmp, 00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"tocehi.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005528.00000001.158408.074B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SleepConditionVariableSRW at 00000000-00006328-7616-159-00189779\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00006328-7616-225-0018F15D\n TpSetTimer at 00000000-00006328-7616-260-0018B2AC\n TpSetTimer at 00000000-00006328-7616-360-0018B352\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006328-7616-390-0018C1F7\n Sleep@KERNEL32.DLL at 00000000-00006328-7616-510-00189690","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00006328-7616-131-00193D10\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006328-7616-137-001937F7\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006328-7616-142-00193633","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"IFileOperations\" (Indicator: \"IFileOperation\"; Source: \"00000000-00005528.00000001.158408.074B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$41","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134080465363112632.6328.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8d55d7cad944a3f21aeb1db491f3d6de\\mscorlib.ni.dll\" at 71240000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8d55d7cad944a3f21aeb1db491f3d6de\\mscorlib.ni.dll\" at 71240000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6F3C0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6FF40000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76030000\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76030000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 71220000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76030000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72650000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72650000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76710000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76710000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76710000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" was detected as \".NET\" and name: \"Library\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$45","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$46","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$47","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\schtasks.exe\" [Source: 00000000-00005528-00000BC0-1471136237]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00005528-00000BC0-1471137665]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005528-00000C46-26039274294]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\AIKg\" [Source: 00000000-00005528-00000C46-26039274294], Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\AIKgmyycVaEjJx\" /XML \"%TEMP%\\tmpBEF6.tmp\"\" [Source: 00000000-00005528-00000C46-26506298628]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00006328) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"powershell.exe\" (UID: 00000000-00006328) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"gdyhjjdhbvxgsfe.gotdns.ch\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$48","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\AIKgmyycVaEjJx.exe\"\" (UID: 00000000-00006328)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\AIKgmyycVaEjJx\" /XML \"%TEMP%\\\\tmpBEF6.tmp\"\" (UID: 00000000-00004168)\n Spawned process \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (UID: 00000000-00001144)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\AIKgmyycVaEjJx.exe\"\" (UID: 00000000-00006328)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\AIKgmyycVaEjJx\" /XML \"%TEMP%\\\\tmpBEF6.tmp\"\" (UID: 00000000-00004168)\n Spawned process \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (UID: 00000000-00001144)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpBEF6.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0xdm53ns.inh.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ex5zsdxr.txk.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fmufs4kt.xvw.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w01a5oel.lmt.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$4a","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"tmpBEF6.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmpBEF6.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"tmpBEF6.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmpBEF6.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" queries basic process information of the \"C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (UID: 5528)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4f","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tmpbef6.tmp\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" writes file \"%temp%\\tmpbef6.tmp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_0xdm53ns.inh.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_ex5zsdxr.txk.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_fmufs4kt.xvw.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_w01a5oel.lmt.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\logs.dat\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" writes a file \"%APPDATA%\\logs.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001144-00000C2B-1473599268\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00005528.00000000.157935.00950000.00000004.mdmp, 00000000-00005528.00000001.158408.00977000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00005528.00000000.157935.00950000.00000004.mdmp, 00000000-00005528.00000001.158408.00977000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"16.0.0.0\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"16.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0=\"\n \"4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"\n \"192.168.0.2\"\n \"0.0.0.0\"\n \"5.0.0.2\"\n \"3.3.0.0\"\n \"3.2.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$54","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"gdyhjjdhbvxgsfe.gotdns.ch\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001144\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file process \"00000000-00005528\"\n YARA signature to detect high entropy file process \"00000000-00001144\"\n YARA signature to detect high entropy file file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00005528\"\n YARA signature to detect medium entropy file process \"00000000-00006328\"\n YARA signature to detect medium entropy file process \"00000000-00001144\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00005528\"\n YARA signature for RC4 encryption matched on process \"00000000-00001144\"\n YARA signature for RC4 encryption matched on process \"00000000-00006328\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005528\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in process \"00000000-00005528\"\n YARA signature matched on R0R instruction used in process \"00000000-00001144\"\n YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLE100D4AACD222F6DC2CE684E96C99]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE100D4AACD222F6DC2CE684E96C99]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp, 00000000-00005528.00000001.158408.07290000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE84D1DA391739C8D0BCC81E0C140C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEEAEB63778FB90D243E728E459CEC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp, 00000000-00005528.00000001.158408.07290000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; File: \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001144.00000001.160633.00E12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations (Dotnet)","description":"Observed namespace \"System.Data.SqlClient.SqlDataAdapter\" and TypeReference \".ctor\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"\n Observed namespace \"System.Data.SqlClient.SqlConnection\" and TypeReference \"CreateCommand\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"\n Observed namespace \"System.Data.SqlClient.SqlDataAdapter\" and TypeReference \"set_SelectCommand\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"\n Observed namespace \"System.Data.SqlClient.SqlConnection\" and TypeReference \".ctor\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \".ctor\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"ExecuteReader\" in \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\"","origin":"Static Parser","mitre_attack_id":"T1213","relevance":10,"id":"static-175","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetUserNameW\" (UID: 00000000-00005528)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006328)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"GetUserNameW\" (UID: 00000000-00001144)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"72d6698\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp, 00000000-00005528.00000001.158408.6F2EF000.00000002.mdmp, 00000000-00005528.00000001.158408.6F389000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005528.00000001.158408.07970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001144.00000000.158712.00400000.00000040.mdmp\n 00000000-00001144.00000001.160633.00400000.00000040.mdmp\n 00000000-00001144.00000002.162553.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"\\key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"SHDeleteKeyW\" in \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005528-00000C2B-1461095491\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005528-00000C2B-1462672871\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006328-00000C2B-1475327385\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006328-00000C2B-1475327417\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$60","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"e3\\DosDevices\\C:\\??\\Volume{\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00005528.00000001.158408.00977000.00000004.mdmp\")\n Found string \"Device\\HarddiskVolume3\\DosDevices\\C:\\??\\Volume{44294f7c-6083-41c6-8176-3c202d755616}0008\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00005528.00000001.158408.07290000.00000004.mdmp\")\n Found string \"Device\\HarddiskVolume3\\DosDevices\\C:\\??\\Volume{44294f7c-6083-41c6-8176-3c202d755616}e-f\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00005528.00000001.158408.07290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\AIKgmyycVaEjJx.exe\"\" (UID: 00000000-00006328)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"logs.dat has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006328]\n Dropped file: \"logs.dat\" - Location: [%APPDATA%\\logs.dat]- [targetUID: 00000000-00001144]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" has section name .text with entropy \"7.819800453690501\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"gdyhjjdhbvxgsfe.gotdns.ch\"\n \"pServiceName\": \"2718\"\n \"pHints\": \"0\"\n \"ppResult\": \"0000000088c85a01\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005528)\n \"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00006328-7616-133-00193CD0\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00006328-7616-134-00193CB0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006328-7616-166-00192D29\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006328-7616-243-0018FC7B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006328-7616-318-0018FC5B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006328-7616-368-0018EBE0\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00006328-7616-447-0018BF19\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006328-7616-487-00189D0A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00006328-7616-512-00186400","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Thread ID: 5896) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"18/27 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00006328-7616-137-001937F7\n FindResourceExW@KERNEL32.DLL at 00000000-00006328-7616-141-001936C2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpBEF6.tmp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0xdm53ns.inh.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ex5zsdxr.txk.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fmufs4kt.xvw.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_w01a5oel.lmt.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" claims program is from Mon Aug 25 19:12:12 2098","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\AIKg\" - (UID: 00000000-00005528), \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\AIKgmyycVaEjJx\" /XML \"%TEMP%\\tmpBEF6.tmp\"\" - (UID: 00000000-00005528), \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" called \"CreateProcessA\" with parameter \"C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" - (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Cryptographic Related","name":"Able to use RSA keys for encryption and decryption","description":"Found RSA private key marker \"-----BEGIN RSA PRIVATE KEY-----\" in \"-----BEGIN RSA PRIVATE KEY-----\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")\n Found RSA private key marker \"-----END RSA PRIVATE KEY-----\" in \"-----END RSA PRIVATE KEY-----\" (Source: \"00000000-00001144.00000000.158712.00400000.00000040.mdmp, 00000000-00001144.00000001.160633.00400000.00000040.mdmp, 00000000-00001144.00000002.162553.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":6,"id":"string-799","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"18/27 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"18/27 Antivirus vendors marked spawned process \"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (PID: 1144) as malicious (classified as \"MSIL_Troj.COT.gen\" with 66% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Found an indicator for a scheduled task trigger","description":"file/memory contains long string with (Indicator: \"LogonTrigger\"; File: \"tmpBEF6.tmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73E40000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\AIKgmyycVaEjJx\" /XML \"%TEMP%\\\\tmpBEF6.tmp\"\" (UID: 00000000-00004168)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\AIKgmyycVaEjJx\" /XML \"%TEMP%\\\\tmpBEF6.tmp\"\" (UID: 00000000-00004168)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" set thread context in remote process \"C:\\7a1bb4fe0f62425fdd2e163ea17d84465323c4f2df8aabb8a50b1433e7d42a9f.exe\" (PID: 478)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$61","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"},{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - LNK file executes using PowerShell","description":"YARA signature for LNK file executes using PowerShell matched on process \"00000000-00006328\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":9,"id":"yara-50","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtUpdateWnfStateData@NTDLL.DLL at 00000000-00006328-7616-242-0018FDEB\n NtQueryWnfStateData@NTDLL.DLL at 00000000-00006328-7616-251-0018FD90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"691d8be41a3b88ccf50e93e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$62","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$63","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"D ^ 2\" (Indicator: \" ^ \"; Source: \"00000000-00005900.00000001.284944.08630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve default system language settings","description":"Found string \"\"Get-Alias\", \"Get-Culture\", \"Get-Date\", \"Get-Host\", \"Get-Member\", \"Get-Random\", \"Get-UICulture\",\" (Source: \"00000000-00005900.00000001.284944.078B6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-655","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005900.00000000.284417.003B1000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005900.00000000.284417.003B1000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005900.00000000.284417.003B1000.00000002.mdmp, 00000000-00005900.00000000.284417.70CA5000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005900.00000000.284417.003B1000.00000002.mdmp, 00000000-00005900.00000000.284417.70CA5000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005900.00000000.284417.70CA5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6918c4c88e2883ce740a8ba6"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"